Source Code in AI Coding Assistants: Keeping Secrets Out of Copilot, ChatGPT, and Claude

Short answer: Source code is one of the highest-value, easiest-to-leak assets in a modern engineering organization, and AI coding assistants — GitHub Copilot, ChatGPT, Claude, Cursor, Windsurf, Amazon Q Developer, Codeium — all create new exposure paths that traditional secret scanning and DLP were never designed to catch. This guide explains, in plain English, the specific ways code leaks into AI tools in 2026, what each provider actually does with prompts and completions, and the controls that engineering and security teams can deploy without slowing developers down.

Why source code is harder to protect than customer data

For most companies, source code carries three kinds of risk simultaneously:

1. Trade secrets. Algorithms, infrastructure designs, and product internals that derive their value from being non-public. Disclosure can be irreversible — once a competitor sees an architecture diagram, you cannot un-disclose it.
2. Embedded secrets. Hard-coded API keys, database URLs, OAuth tokens, JWT signing keys, third-party credentials, and PII test fixtures. A leaked key may grant access to production within minutes of the leak. GitGuardian counted 23.77 million new hardcoded secrets on public GitHub in 2024, and found a higher leak rate in repositories using Copilot.
3. Vulnerabilities pre-disclosure. Code that contains a security bug not yet fixed. Public exposure before patch release is functionally a zero-day.

Customer-data DLP focuses on patterns the data itself contains (SSNs, card numbers). Source-code DLP has to also reason about what the code knows or implements — which is much harder for a regex-based system to detect.

The four common code-leakage paths through AI tools

1. Pasting code into a chat to "fix this for me"

The most common pattern in 2024–2026: a developer copies a function, file, or stack trace into ChatGPT, Claude, or Gemini and asks for help. The block may include API keys in test fixtures, customer-data examples in test cases, comments referencing internal architecture, or a license header that itself reveals proprietary status.

Why it slips past existing controls. Secret scanning runs on commits, pull requests, or push events. Most endpoint DLP that does watch the browser is tuned for pattern data such as card numbers, not for code.

What to do. Redact at the source. Locke 1.0 detects sensitive entities — including secret-pattern formats (AWS keys, Stripe keys, JWTs), customer identifiers, and explicit PROPRIETARY markers — and replaces them with one-way placeholders on-device, before the request leaves the device. Reversible tokenization is planned shortly after 1.0. Coverage depends on the app, platform and settings.

2. AI coding assistants reading your repo

Copilot, Codeium, Cursor, Cline, Continue, and similar tools analyze the active file plus relevant context — sometimes the whole repo. Each provider's defaults differ:

• GitHub Copilot Business / Enterprise — GitHub states it does not use Business or Enterprise customer data to train AI models. For IDE code completions, chat, and the CLI, prompts and outputs are not retained by default; for other Copilot surfaces they are retained for up to 28 days by default. Whether suggestions that match public code are blocked, or shown with license references ("code referencing"), is set by the organization's "Suggestions matching public code" policy.
• GitHub Copilot Free / Pro / Pro+ / Max — Since April 24, 2026, GitHub may use interaction data (prompts, suggestions, code snippets and context) from these individual plans to train its models unless the user opts out in Copilot settings; GitHub says it excludes interaction data from users who belong to a paid organization. Business and Enterprise data is not used for training.
• Amazon Q Developer (Pro) — AWS states it does not use Pro-tier content for service improvement; AWS lists IP indemnity as a Pro-tier feature, and the reference tracker flags suggestions that resemble publicly available code.
• Cursor / Windsurf / Cline (Anthropic-or-OpenAI-backed) — Vary by configuration; review settings and provider DPA before enabling on private repos. Cursor, for example, has a Privacy Mode that a team or enterprise admin can enforce. The same review applies to terminal-based agents — see Is Claude Code Safe for Sensitive Code?.

What to do. Audit the assistant's settings per repo. Disable repo-wide context for sensitive repos, or run such repos with a self-hosted assistant.

3. Implicit secrets in prompts and stack traces

Even careful developers paste stack traces, log snippets, environment-dump output, or error messages into AI tools — content that often contains tokens, hostnames, IP ranges, or path names that reveal infrastructure. A stack trace from a production incident is rarely sanitized in the rush to get help.

What to do. Train the team to redact production output before pasting. Better, screen it on the device with the same local-first tool used for code: Locke's companion browser extension covers AI websites, and its local proxy covers command-line, script and SDK traffic. Make the safe path the easy path.

4. Prompt injection via dependency / fetched-content

When a coding agent reads files from outside the user's own repo — a fetched dependency, a README from a remote project, a copied-in third-party SDK — it may ingest content authored by an attacker. Indirect prompt injection — OWASP's LLM01:2025 — covers exactly this case: instructions hidden in files or web content the agent reads can tell it to leak environment variables, modify generated code, or run unintended shell commands. (See our prompt injection explainer for the broader threat model.)

What to do. Limit what the agent can do — not just what it can read. Apply egress allow-listing to the agent runtime, validate generated code with a deterministic linter / SAST step before execution, and require human confirmation for high-impact tool calls.

What providers actually do with your code in 2026

These positions move; verify against the current vendor product pages before relying on them. For private repos, the difference between consumer and enterprise tier is the difference between "your code may train future models" and "your code is processed under contractual confidentiality."

What "private context" really means

Several AI coding tools advertise "your code stays private." Read what is actually being claimed:

• No training use. Most enterprise tiers commit to this. Important but limited — it does not prevent transit, retention for abuse monitoring, or human review on flagged content.
• Zero retention. Stronger: prompts and completions are not stored beyond the duration of the request. Available on enterprise tiers from major vendors; usually requires an explicit configuration.
• Local execution. The strongest claim: model inference happens on the user's device. Available from a small number of products (e.g., self-hosted deployments, some IDE-based small models). Latency and capability trade-offs are real.

For most teams, the practical sweet spot is enterprise tier + zero retention + local-first redaction on the device — strong contractual posture for the agent's primary work, plus a deterministic technical control to prevent the most-sensitive bits from ever leaving the device.

A workflow that scales without slowing developers

Below is a pattern several engineering organizations have adopted in 2025–2026:

1. Tool selection. Approve specific AI coding products under enterprise contracts (GitHub Copilot Enterprise, Claude for Work, Cursor with enterprise terms, etc.). Block consumer endpoints at the network and identity layers for engineering accounts.
2. Repo classification. Tag each repo with a sensitivity level. High-sensitivity repos get stricter assistant settings (no fetch outside repo, no telemetry beyond the necessary minimum, mandatory secret scanning on every commit and every push).
3. Device-level redaction for chat-style AI. Deploy a local-first tool such as Locke on developer devices. Locke runs on the device as a desktop app; its companion browser extension screens AI websites, and a local proxy screens command-line, script and SDK traffic. Locke 1.0 detects secrets (cloud-provider keys, JWTs, private keys, internal hostnames, customer data fixtures) and replaces them with one-way placeholders before the request leaves the device. Coverage depends on the app, platform and settings.
4. Pre-commit + pre-push secret scanning. Use a tool like detect-secrets, gitleaks, or trufflehog configured for your secret patterns. Make the scan blocking — the cost of an accidentally committed key is days of rotation.
5. Indirect-injection defense for agentic tools. For agents that fetch and act, restrict the action surface. Allow-list outbound destinations from the agent runtime. Require human confirmation for sensitive tools (file delete, git push, deploy, secret read).
6. Auditing and review. Sample a percentage of AI-assisted PRs each sprint for security review, especially around authentication, authorization, and crypto. AI code is often syntactically clean and subtly wrong.
7. Training and honeypots. Run periodic fire drills: planted "fake secret" files in low-traffic repos to verify your secret scanning catches them. Train new hires on the AI policy as part of onboarding, not optional reading.

Examples: what is and is not safe

Frequently asked questions

Does GitHub Copilot Enterprise see all my code?

Copilot processes the active file and contextual snippets to produce suggestions. With Business and Enterprise plans, prompts are not used for training; prompts sent from the IDE are not retained by default, while other Copilot surfaces keep them for up to 28 days. Features that build a persistent index of your code — today, Copilot Spaces, which replaced Knowledge Bases in November 2025 — are opt-in. Admins can also set content exclusions so that specified files are never sent to Copilot. Read the product page for the current architecture.

Are AI completions copyrightable, and do they create license risk?

This is an evolving area. Several providers offer IP indemnification for generated code under paid business tiers (Microsoft's Customer Copyright Commitment, which covers GitHub Copilot Business and Enterprise; AWS for Amazon Q Developer Pro). Conditions vary and change: Microsoft dropped the requirement to enable Copilot's duplicate-detection filter in April 2026, but coverage still applies to unmodified outputs and still requires use of the built-in guardrails for other Copilots. Read the current indemnification clauses; they are not all alike.

Is it safe to use AI for security-relevant code (auth, crypto, SAST)?

AI tools can help draft and review such code, but treat their output as a junior engineer's first pass. Security-relevant changes should go through human review by someone qualified, plus deterministic tooling (linters, SAST, dependency analysis). AI-generated code is frequently plausible and subtly wrong; treat it as a first draft.

What's the difference between secret scanning and code redaction?

Secret scanning checks files at commit / push time and blocks known patterns. Code redaction on the device catches secrets before they leave it — including ad-hoc paste-into-chat scenarios that secret scanning never sees. Use both; they cover different points in the lifecycle.

How do indemnification clauses interact with redaction?

Indemnities cover output; nothing in them protects the data you put in. Controlling input with a redaction layer is a complementary control, not a condition of the indemnity. Combining a vendor that indemnifies output with a redaction layer that controls input is a stronger posture than either alone.

Are there standards for AI-coding-tool governance?

Several emerging frameworks help: ISO/IEC 42001 (AI management systems), NIST AI RMF, OWASP Top 10 for LLM Applications (2025), and SLSA (supply-chain integrity) intersect with AI-coding-tool decisions. These are starting points; tailor to the specific products and risk you accept.

A short checklist for engineering and security leaders

• Inventory every AI coding tool actually in use (sanctioned and not).
• Choose enterprise tiers with DPAs and no-training commitments; block consumer endpoints at the network and identity layers.
• Deploy local-first redaction on developer devices for chat-style AI tools.
• Make secret scanning blocking at pre-commit and pre-push.
• Classify repos by sensitivity; configure assistants per class.
• Restrict the action surface and outbound network of agentic tools.
• Sample AI-assisted PRs for security review each sprint, focused on auth, authz, and crypto.
• Add prompt-injection scenarios to red-team exercises.
• Update the engineering handbook so the AI policy is on day one, not in a quarterly compliance reminder.

The bottom line

In 2026, AI coding assistants are net positive for almost every engineering team — but the threat surface has moved. Source code, secrets, and architectural detail can leak through routes that traditional DLP and secret scanning never watch. The defense is the same defense in depth that has always worked: enterprise contracts, local-first redaction at the input layer, strict action surfaces for agents, and human review for security-relevant code. Get those right and AI is a productivity multiplier. Skip them and you are training someone else's model on your codebase, one paste at a time.

Sources and primary references

Reviewed November 2, 2026. Regulations are cited to their official text. Vendor statements are cited to the vendor's own documentation as it read on that date; vendors revise these pages, so confirm before relying on them.

• GitHub Copilot Trust Center FAQ — Business and Enterprise data not used for training; IDE prompts not retained by default, 28-day default elsewhere; IP indemnification terms.
• Managing GitHub Copilot policies as an individual subscriber — April 24, 2026 training policy for Free, Pro, Pro+ and Max and the opt-out setting.
• Updates to GitHub Copilot interaction data usage policy — what "interaction data" includes; Business and Enterprise unaffected.
• GitHub Copilot plans — current plan names; audit logs and content exclusion included for Business and Enterprise.
• GitHub Generative AI Services Terms — GitHub will not use Inputs or Outputs to train generative AI models absent documented instructions.
• Content exclusion for GitHub Copilot — admins can keep specified files out of Copilot context.
• Code referencing in GitHub Copilot — public-code matching, and that policy determines block versus show.
• Sunset notice: Copilot knowledge bases — Knowledge Bases retired November 1, 2025; replaced by Copilot Spaces.
• Customer Copyright Commitment Required Mitigations — as of April 3, 2026 the duplicate-detection filter is no longer required for coverage.
• Enterprise privacy at OpenAI — no training by default on Business, Enterprise, Edu and API data; admin-controlled retention; 30-day deletion.
• OpenAI API: Your data — 30-day abuse-monitoring logs; zero data retention subject to approval.
• OpenAI Data Controls FAQ — consumer "Improve the model for everyone" toggle.
• Anthropic: Updates to Consumer Terms and Privacy Policy — consumer users choose whether chats train Claude; five-year versus 30-day retention; commercial products unaffected.
• Anthropic Privacy Center: Is my data used for model training? (commercial) — commercial inputs and outputs not used for training by default.
• Amazon Q Developer service improvement — Pro-tier content not used for service improvement.
• Amazon Q Developer FAQs — reference tracker for suggestions resembling public code.
• Cursor security — Privacy Mode, enforceable by a team or enterprise admin.
• Gemini Apps Privacy Hub — human review, 18-month default retention, training while Keep Activity is on.
• Generative AI in Google Workspace Privacy Hub — Workspace customer data not used for training without permission.
• Vertex AI generative AI data governance — no training on customer data without permission; 24-hour cache.
• Data, privacy, and security for Microsoft Copilot — prompts and responses not used to train foundation LLMs; enterprise data protection.
• Microsoft Purview data security and compliance protections for generative AI apps — endpoint DLP can block pastes of pattern data into ChatGPT.
• OWASP Top 10 for LLM Applications 2025 — current list, including LLM01:2025 Prompt Injection.
• NIST AI Risk Management Framework — AI RMF 1.0 (January 2023) and Generative AI Profile (July 2024).
• Microsoft compliance offering: ISO/IEC 42001 — description of the AI management system standard (the ISO page itself could not be opened).
• SLSA — Supply-chain Levels for Software Artifacts.
• GitGuardian State of Secrets Sprawl 2025 — 23.77 million new hardcoded secrets on public GitHub in 2024; higher leak rate in repositories using Copilot.