Skip to main content

Pro audit program · v1.0

AI Coding Assistant Security

Copilot / Cursor / Claude Code / Codeium / equivalent — quick audit of how AI code assistants are deployed in your engineering org.

  • General target area
  • NIST AI RMF framework
  • 8 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Copilot / Cursor / Claude Code / Codeium / equivalent — quick audit of how AI code assistants are deployed in your engineering org.

Risks addressed

  • Critical Source code or IP sent to a free-tier assistant for training
  • High Vulnerable AI-generated code shipped without review
  • High Secrets in suggestions leak into commits
  • Medium Licence-incompatible code generated and not flagged

Controls (8)

  1. Approved AI coding assistants list

    High

    This control establishes and maintains an organization-approved list of AI coding assistants (such as GitHub Copilot, Amazon CodeWhisperer, or Tabnine) that developers are authorized to use for software development activities. The list defines which tools have been vetted for security,…

    How to test + evidence

    Testing procedure: Single approved tool (or short list) with enterprise plan + DPA.

    Evidence to collect: Approved tool register.

  2. Enterprise tier — no training on customer code

    Critical

    This control ensures that AI/ML models deployed at the enterprise tier are trained exclusively on sanitized, anonymized, or synthetic datasets and explicitly prohibited from training on live customer data, production code repositories, or proprietary client intellectual property. Organizations implement technical…

    How to test + evidence

    Testing procedure: Contract clause: code submitted is not used to train the providers shared models.

    Evidence to collect: Signed DPA / contract clause.

  3. Repo-level scope + opt-out for sensitive code

    High

    This control enforces that AI coding assistants and code generation tools operate with repository-level configuration scopes, allowing explicit opt-out mechanisms for sensitive code repositories, directories, or files. Organizations define exclusion patterns (e.g., .gitignore-style rules, repository metadata tags, or policy files)…

    How to test + evidence

    Testing procedure: Sensitive repos / paths excluded from assistant context.

    Evidence to collect: Scope config screenshot.

  4. Secret scanning on every commit (incl. AI-generated)

    Critical

    This control requires automated secret scanning tools to analyze every code commit—including commits containing AI-generated code—before or immediately after merge to detect exposed credentials, API keys, private keys, tokens, and other sensitive authentication material. Scanning must trigger on all commits…

    How to test + evidence

    Testing procedure: Pre-commit + push protection catches secrets the assistant suggested.

    Evidence to collect: Scanner config + last blocks.

  5. AI-generated code subject to normal PR review

    High

    This control requires that all source code generated by artificial intelligence tools (such as GitHub Copilot, ChatGPT, Amazon CodeWhisperer, or similar assistants) undergo the same peer review process as human-written code before merging into production branches. Developers must submit AI-generated…

    How to test + evidence

    Testing procedure: Policy: AI output is treated as untrusted input; reviewer attests.

    Evidence to collect: Policy + PR template.

  6. SAST / SCA in CI catches insecure AI suggestions

    High

    This control requires Static Application Security Testing (SAST) and Software Composition Analysis (SCA) tools to be integrated into the Continuous Integration (CI) pipeline, with rulesets configured to detect insecure code patterns that may originate from AI-assisted coding tools such as…

    How to test + evidence

    Testing procedure: Same security gates as any other code change.

    Evidence to collect: CI workflow.

  7. Licence / IP scanning on AI output

    Medium

    This control applies automated or manual scanning processes to AI-generated content outputs to detect embedded copyrighted material, licensed code snippets, or other intellectual property that may trigger legal or licensing obligations. Scanning occurs before AI outputs are incorporated into production…

    How to test + evidence

    Testing procedure: Tool flags suspiciously-similar code blocks; legal review for ambiguous cases.

    Evidence to collect: Scanner config + last flags.

  8. Telemetry + audit: who used what, when

    Medium

    This control requires the implementation of comprehensive logging and auditing mechanisms that capture user access to sensitive systems, data, and applications, recording the identity of the user (who), the resource accessed or action performed (what), and the timestamp (when). Telemetry…

    How to test + evidence

    Testing procedure: Tenant admin logs available; reviewed monthly.

    Evidence to collect: Audit log sample.