HOW TO SECURE GOOGLE JULES - SECURITY GUIDE | VIBEEVAL

Google Jules Security Context

Jules is Google’s asynchronous coding agent (jules.google), powered by Gemini. You connect a GitHub repo, hand it a task, and it clones the repo into a secure Google Cloud VM, works autonomously — plans, edits, runs tests — and opens a pull request when done. Two distinct risk surfaces: (1) what the agent can reach — the GitHub App’s repo scope, every file in the clone including committed secrets, and any repo content that can steer it via prompt injection; and (2) what code it produces — the same default-insecure patterns we see across every AI code-gen tool. The async model means there is no human watching the session; the pull request review is your one synchronous control point. Treat it that way.

Security Checklist

1. Grant the GitHub App per-repo, not all-repos

When you install the Jules GitHub App, choose “Only select repositories” and pick the specific repos you want it working in. An all-repos grant means the agent — and anything that manages to steer it — can read every private repo in the org. Re-check the installation’s repository access in GitHub under Settings → Applications whenever you add repos.

2. Verify branch protections before connecting a repo

Before you let an agent open PRs against a repo, confirm main has branch protection: required reviews, required status checks, no force pushes, no direct pushes. An agent PR into an unprotected default branch is one accidental merge away from production. Audit this per repo, not per org.

3. Read the diff — green CI is not a review

The core failure mode with async agents is approving the PR because the tests pass. Tests written by the same agent pass by construction. Read every changed file, including ones you did not expect the task to touch. Look specifically for relaxed assertions, deleted auth checks, and “helpful” edits to CI config or workflows.

4. Audit secrets in the repo before the first task

Jules clones the full repo into its VM — everything in the working tree is visible to the agent and can be referenced in its output or its diffs. Run trufflehog filesystem . or gitleaks detect before connecting. A key committed three years ago in a forgotten config file is now in an agent’s context.

5. Treat repo content as part of the prompt

The agent reads READMEs, config files, code comments, and issue text to understand the task. All of that is untrusted input from the model’s perspective — a poisoned README in a vendored dependency or a crafted issue body can carry instructions the agent may follow. Review indirect prompt injection for the recurring shapes, and be deliberate about which issues you point the agent at.

6. Write security constraints into the task

The task prompt is your only steering input before the PR lands. Include constraints explicitly: “parameterize all SQL,” “no new dependencies without flagging them,” “do not modify CI workflows or auth middleware.” Async agents follow the brief they were given; an underspecified brief produces underspecified security.

7. Review the plan when Jules presents one

Jules plans before it edits. When a plan is surfaced for approval, actually read it — it is the cheapest point to catch scope creep (“also refactor the auth module”) before any code exists. Reject and re-scope rather than fixing at PR time.

8. Validate every dependency the PR adds

Diff package.json / requirements.txt / go.mod in every Jules PR. Confirm each new package exists, is the package you think it is, and is actively maintained — hallucinated and typosquatted names are an AI-specific failure mode. The Package Hallucination Scanner covers that subset; npm audit covers known CVEs.

9. Test generated authentication end-to-end

When a Jules PR wires in auth, test the flow yourself: sign up → verify → log in → log out → reset → log in. Look for tokens in localStorage, missing email verification, and unbounded session lifetimes. Do not assume the agent’s own test run exercised the unhappy paths.

10. Audit generated database queries

grep -nE 'SELECT|INSERT|UPDATE|DELETE' across the PR diff. Every match should use parameterized queries or an ORM with prepared statements. String-concatenated SQL in an agent PR is injection waiting for input.

11. Test authorization on new routes

For every API route a Jules PR adds, test with an unauthenticated request, a wrong-user authenticated request, and a correct-user request. The recurring shape is a CRUD endpoint that filters by ID without checking ownership — see BOLA in AI-generated CRUD.

12. Review file operation paths

Every fs.readFile, fs.writeFile, or os.path.join call in the diff where part of the path derives from user input is a potential path traversal. Constrain to a base directory and verify the resolved path stays inside it.

13. Check generated logging for credentials

Search the diff for console.log, logger.info, and friends near password, token, or secret fields. The pattern is “log the request body for debugging” — which logs the credentials.

14. Sanitize PR descriptions and commit messages

Jules writes its own PR descriptions and commit messages from what it saw in the repo. Before merging (and especially in public repos), read them for internal URLs, environment details, or secret values echoed from files it read.

15. Keep agent PRs off release branches

Point Jules tasks at feature branches and let your normal promotion flow move code toward release. Never configure a workflow where an agent PR can target a branch that auto-deploys on merge without a human review in between.

16. Run an automated security scan

After a Jules PR ships to a deployed environment, the Vibe Code Scanner covers the AI-specific deploy patterns; the full VibeEval scan adds BOLA, role escalation, and webhook trust.

Related Resources

Is Google Jules Safe?

Security profile in the broader AI coding context.

Free Self-Audit Suite

Five free scanners.

Google Jules Security Checklist

Pre-merge checklist for agent PRs.

Automate Your Security Checks

VibeEval scans applications shipped via Google Jules. Findings ship as paste-ready prompts — drop them straight into the next Jules task for one-shot remediation.