When an AI coding agent pulls a dependency, it does not stop to check whether that component is carrying known vulnerabilities into your codebase. This video shows what happens when you connect an ActiveState Curated Catalog to Windsurf Agent, giving your AI agents a vetted, policy-governed source of open source components with full provenance on everything they pull.

Using the ActiveState secure skill, Windsurf Agent  tests your existing environment, scans your open source dependencies against the ActiveState Curated Catalog for known CVEs, and handles remediation automatically, without requiring manual intervention from the developer.

For security leaders managing teams where AI-generated code is accelerating dependency ingestion faster than any manual review process can keep pace with, this is what governed open source consumption looks like in practice. For developers, it means the tools you are already using are pulling from sources your security team has already approved.

This is part of an ongoing series demonstrating how ActiveState Curated Catalogs integrate with the AI coding tools your teams are already using.