Our PMs' prototypes install whatever packages the coding agent suggests. Security wants to ban PM prototyping. What do you propose instead?

Models sometimes invent package names, and attackers register them. Keep prototyping, but allow-list common libraries, check that new packages exist and are established, and install in a sandbox with no secrets.

Updated Nov 2026 · Original practice questions with worked answers and teaching rubrics. Our editorial policy explains the sources, review process and limits.