Research a security alert and draft a cited brief
A Valyu tutorial builds an agent that takes a known Next.js security alert, gathers public advisories and sources, and writes a cited brief with open questions for human review.
Done with Custom agent
What they did
The author built a small agent around a past Next.js security alert. Code first checks the installed version against the public GitHub advisory and a government list of exploited bugs. The agent then searches a few trusted sites through Valyu and picks source passages. It ends by drafting review questions for a developer.
How it went
The tutorial shares the complete script. It reports that the agent outputs a brief that cites real source text. The model is not allowed to rewrite quotes or give a final verdict.
Worth knowing
The agent does not scan your app or prove you are exposed. Its free-form questions can still contain unsupported claims and need a human check. Search and model calls both cost money.
Try it yourself
I received a security alert for [package name] version [exact version], identifier [alert ID]. Find the official advisory and check whether my version falls in the affected range. Check whether the issue is listed as actively exploited. Search only trusted sources such as the vendor's site and public advisory databases, and quote the exact passages you rely on with links. Then list the deployment conditions I still need to check myself. Do not change my code or install anything. Give me the brief for review.
Swap the highlighted [parts] for your own details.
Source: DEV Community · Prosper Otemuyiwa · Oct 19, 2026
Written with AI assistance from the original post and checked against our editorial guidelines. Results are as reported by the source, not independently verified. Spotted a mistake? Tell us.
