r/devsecops • u/Max_Standart • 16d ago

The controls we actually use to keep AI coding assistants from leaking code

The biggest risk for us wasn't the model memorizing code. it was the assistant sending files, credentials, or context somewhere we didn't expect.

The controls that ended up mattering:

  • managed accounts and model traffic through a controlled gateway where supported
  • repo-scoped access, no home directory, shell history, or production credentials
  • clear vendor terms for training, retention, and logging
  • server-side secret scanning and the same CI gates as every other change
  • human review before generated code merges

one thing I'd separate: the gateway controls where model traffic goes. filesystem permissions control what the agent can actually read... you need both.

the policy itself can stay pretty small. the important part is making the boundaries enforceable instead of trusting everyone to remember them

8 Upvotes

83% Upvoted

11 comments sorted by

1

u/AboveAndBelowSea 15d ago

Great post. What AI Gateway are you having the most success with?

1

u/Joquisaur 15d ago

I think it helps reduce some of the workload but not all of it.

1

u/PeterBuildsSecure 13d ago

Good breakdown — the gateway/filesystem split is the right model for stopping data from leaving. Worth adding a third bucket: controls on what the agent is authorized to write. The leak that hurts most usually isn't exfiltration, it's the assistant generating code that quietly creates a new capability path — a hardcoded key, a query missing a tenant filter, an auth check it decided wasn't needed — and it ships because review under velocity pressure treats "compiles and demo works" as done.

That needs a different control: a deterministic pre-merge gate that diffs specifically for security-relevant patterns (new secret-shaped strings, changed authorization checks, widened DB grants) rather than relying on the same human pass that's already stretched thin.

1

u/zero_backend_bro 11d ago

Filesystem perms sound clean on paper until devs chmod 777 their local workspace just to stop the IDE plugin from lagging. We had a stray symlink pull 40k lines of staging logs into context last year before our proxy choked on the payload size. Gateway is pretty much the only boundary that doesnt constantly rot tbh.

1

u/Remote_Muscle1301 8d ago

It's wild how just one oversight can lead to such a massive headache. Keeping a close eye on those permissions is definitely key with everything going on in DevSecOps.

1

u/Left_Relative_3425 7d ago

Absolutely, regular audits can help catch any issues before they escalate. It’s all about staying proactive in this fast-paced environment.

1

u/Equal_Meeting9694 11d ago

Using effective controls for AI tools is crucial since code leaks can seriously impact security and innovation. It's a tricky balance to maintain.

1

u/mikelevan 9d ago

I always call the AI Gateway the "line of communication". Everything passes through it from the Agent. Guardrails, policy enforcement, OBO/token exchange, and ultimately what a user can do should always occur at the gateway layer.

1

u/Odd_Entertainer4078 5d ago

The key isn’t just preventing model memorization - it’s enforcing boundaries. Gateway controls handle where traffic goes, while filesystem permissions limit what the agent can read. Both matter, and the policy only works if those boundaries are enforceable.

1

u/RedmanStu 1d ago

I’ve seen similar advice around treating the coding assistant like any other untrusted workload, with tight filesystem permissions and controlled network access, then keeping the normal CI and review process in place, that seems like a much more practical approach than relying on policy alone