Preventing AI Code Scanners from Leaking Credentials in CI/CD
How automated PR review bots, LLM security scanners, and CI/CD pipelines handle secrets, environment variables, and build artifacts.
AI tool security & privacy
What AI coding assistants and chatbots do with what you feed them: retention windows, training opt-outs, sub-processors, and how consumer terms differ from enterprise ones.
Zero Data Retention in AI Tools: What It Means and Who Offers It
How Zero Data Retention (ZDR) works in enterprise AI APIs, memory scrubbing, audit logs, and provider compliance comparison.
Is it safe to put client code into Cursor?
Cursor's privacy policy states no retention period and never mentions Privacy Mode. What Anysphere commits to on training, and the gap between documents.
Is it safe to put client code into GitHub Copilot?
On individual Copilot plans, training on your data is on by default since April 2026. What the docs say, which models see your code, and what to change.
AI Tools in a SOC 2 Audit: What Evidence You Need
How to prepare auditor evidence, control mapping, and vendor oversight documentation for AI assistants in a SOC 2 Type II assessment.
How to Stop Secrets Leaking into an AI Assistant
Practical techniques to prevent API keys, database credentials, and tokens from being transmitted to AI tools via context buffers and prompts.
RAG Security: Vector Vulnerabilities and Data Leakage
How Retrieval-Augmented Generation architectures leak sensitive data across tenant boundaries, and how to implement vector security.
Securing an AI Agent That Has Tool Access: An Architecture Guide
How to mitigate OWASP LLM06 Excessive Agency when deploying AI agents with shell, database, API, and web browsing tool capabilities.
Before you paste code into an AI assistant: a 9-point check
A security engineer's checklist for AI coding tools: what to establish about retention, training use and sub-processors before your code leaves.
Can You Use AI Coding Tools Under an NDA?
How proprietary code transmission to AI assistants intersects with confidentiality agreements, trade secrets, and client contracts.
Free vs Paid AI Tools: What Actually Changes in the Terms
How consumer, pro, team, and enterprise AI tiers differ on training opt-outs, prompt retention, data residency, and legal liability.
OWASP LLM Top 10: AI Security Vulnerabilities Explained
A plain-language guide to the OWASP Top 10 for Large Language Model Applications, covering prompt injection, data poisoning, and model denial of service.
Prompt injection, explained for people who use AI tools
Why an AI assistant that reads untrusted content can be turned against you, what it can and cannot be tricked into, and the mitigations that actually hold.
What your AI coding extension sends that you didn't type
AI assistants in your editor transmit surrounding context, not just your prompt. What gets collected, how secrets leak, and the exclusions to configure.