AI Coding Assistant Security Review — A Checklist Before Rollout

When an AI coding assistant processes source or repository context, the data flow belongs in the security review. The files it can access depend on the product, settings and task; teams should check that flow before a rollout.

The questions are predictable enough to answer in advance. Working through them before the trial costs an afternoon. Working through them after costs a rollout.

What leaves the machine

Start here, because everything else follows from it. Which of these is transmitted, and when:

• The open file, or the whole repository as context?
• Filenames and directory structure, which may reveal architecture or unreleased product details even when file contents are excluded?
• Terminal output, environment variables, or anything visible in the working directory?
• Prompts and the code generated in reply?

Agent-style tools may access more repository context than a completion tool working from the active buffer. Inspect the documented and observed context scope instead of assuming either product class has a fixed boundary.

Retention and training

Two separate questions that vendors sometimes blur.

Retention: how long is your code held, where, and can you require deletion? "Not stored" and "stored transiently for processing" are different answers with different implications.

Training: is your code used to improve models? Policies vary by vendor, plan, settings, provider route and opt-in. For example, Anthropic's current Claude Code documentation says consumer Free/Pro/Max users can choose whether data is used for training, while commercial users are not used for training under commercial terms unless they opt in; Cursor says Privacy Mode prevents training and is available on Free and Pro as well as team plans. Confirm the exact product, account type, settings and contractual terms before a trial.

Secrets

Treat secrets in files the assistant can access as potentially exposed to its context. Confirm what happens next: whether the vendor filters credentials before transmission, whether content appears in retained logs, and what your own detection would catch.

This is also a prompt to check your own house. If a hardcoded credential in a config file is a catastrophe when an assistant reads it, it was already a catastrophe waiting for a laptop to be stolen.

Generated code and licensing

An assistant may produce code that resembles public code; this checklist does not estimate how often that happens for any model or product. Confirm whether the vendor offers output-matching filters or indemnity, and make code review part of the release path. Do not infer a product's training corpus or copying risk from its tool category.

If you ship anything under a license with obligations, this belongs in the review rather than in a footnote.

Access and offboarding

Who can enable it, on which repositories, and what happens when someone leaves? Per-seat tools have a license to reclaim. Usage-based tools have credentials to revoke, and those are easier to forget precisely because there is no seat sitting visibly unused.

If the tool integrates with your source host, check what scopes it requested. Broad read access granted once and never reviewed is a common finding in audits.

Where the tool runs

Terminal-based tools like Claude Code can run on the developer's machine or in a configured remote environment. Editor integrations can also invoke remote services or agents. Browser-based environments can execute or store repository content remotely, depending on the product and configuration. Verify the actual execution and storage path; the interface category alone does not establish where code resides.

None of these is inherently safer. They are different shapes, and your existing controls fit some better than others.

Getting a decision

Bring security in at trial scoping, give them the vendor's documentation rather than the marketing site, and ask for a decision on a specific tier and configuration rather than on "AI assistants" in general. Vague questions get vague refusals.

To weigh policy constraints alongside capability and rollout, the AI Coding Assistant Finder treats procurement and security review as a first-class constraint rather than an afterthought.

Sources

The product categorisations referenced above (terminal-based agents, editor-based assistants, browser-based environments) describe deployment shapes, not security outcomes. Specific data-retention, training, and credential-handling behavior varies by tier, settings, provider route and vendor; do not rely on category-level claims for procurement. Vendor documentation below was checked on 2026-10-01 and can change.

• Anthropic — Claude Code data usage (training and retention by account type, local data flow): https://code.claude.com/docs/en/data-usage — accessed 2026-10-01.
• Cursor — Security (Privacy Mode and training statement): https://cursor.com/security — accessed 2026-10-01.
• GitHub — Managing Copilot policies as an individual subscriber (includes data-use controls and links to business/enterprise protections): https://docs.github.com/copilot/how-tos/manage-your-account/managing-copilot-policies-as-an-individual-subscriber — accessed 2026-10-01.