CyphrQ
Menu

AI Coding Assistant Security: Data, Admin Controls and Code Review

What Claude Code, Continue, Cursor and GitHub Copilot send out, the admin controls that limit them, and the repo rules that still need a human.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

11 min read

AI coding assistant security comes down to three questions: what code and context the tool sends to a model, what the vendor keeps, and what the assistant is allowed to do on your machine. Claude Code, Continue, Cursor and GitHub Copilot answer them differently. Whichever you use, AI-written code still needs the same review and repository rules as human code.

This guide covers the four tools in alphabetical order, from each vendor's own documentation, checked on 25 October 2026. It doesn't rank them. It sits in the AI security section.

AI coding assistant security: what leaves your laptop?

An AI coding assistant is a tool inside your editor or terminal that uses a large language model to suggest, explain or write code. The model usually runs in the cloud, so your code has to travel to it.

What travels is the part to understand:

  • Claude Code. Anthropic's data usage page says: "Claude Code runs locally. To interact with the LLM, Claude Code sends data over the network. This data includes all user prompts and model outputs, encrypted in transit via TLS 1.2+." The same page notes that a session transcript holds "source code, file contents, and other conversation content".
  • Continue. Continue is the open-source option in this group. Its GitHub repository describes "a coding agent available as a CLI, VS Code extension, and JetBrains plugin", under the Apache-2.0 licence. Its documentation has sections on model providers and a guide titled "How to Run Continue Without Internet", so check the terms of whichever model provider your team connects. One fact matters more than any setting: the repository says it "is no longer actively maintained and is read-only for all users."
  • Cursor. Cursor's security page (last updated 25 August 2026) says the app "makes requests to Cursor backend domains to deliver API, update, and marketplace functionality."
  • GitHub Copilot. GitHub's content exclusion documentation shows that Copilot uses your files as context unless you exclude them: an excluded file gets no inline suggestions, and "Copilot Chat will not be able to use the file to generate a response."

The practical point: anything the assistant can read, it can send. That includes a .env file, a pasted stack trace with a token in it, or terminal output.

Do AI coding assistants train on your company's code?

Anthropic says no for Claude Code under commercial terms, GitHub says no for Copilot Business and Enterprise, and Cursor says no when Privacy Mode is on. The detail sits in retention, settings and opt-ins.

Tool Training on business data Retention and options (as documented)
Claude Code Not under commercial terms, unless the customer opts in 30 days standard for Team, Enterprise and API; zero data retention for qualified Enterprise accounts
Continue Check the model provider you connect The final 2.0.0 release included "removing anonymous telemetry"
Cursor "When enabled, we will not train on your data" (Privacy Mode) Privacy Mode can be set by a team or enterprise admin
GitHub Copilot No, for Business and Enterprise Prompts and suggestions not retained in IDE chat and completions; 28 days on github.com, mobile and CLI

Claude Code. Anthropic states that it "does not train generative models using code or prompts sent to Claude Code under commercial terms", unless the customer chooses to share data, for example through the Development Partner Program. Zero data retention "is not included in the standard Enterprise plan"; the account team enables it per organisation. Two details worth knowing: transcripts sent with /feedback, /bug or /share "are retained for 5 years", and consumer accounts that allow model improvement have a 5-year retention period.

Cursor. Cursor's security page says Privacy Mode "can be enabled in settings or by a team or enterprise admin", and new members "inherit the team's Privacy Mode settings". It lists a SOC 2 Type II attestation, ISO/IEC 27001:2022 and ISO/IEC 42001:2023.

GitHub Copilot. GitHub's Copilot FAQ is direct: "GitHub does not use either Copilot Business or Enterprise data to train its models." For those plans, prompts and suggestions in IDE chat and code completions are "Not retained". Use through github.com, mobile and the CLI is "Retained for 28 days", which GitHub says chat on those surfaces needs. Training on user interactions applies to individual Free, Pro and Pro+ subscribers, who can opt out.

Continue. The terms that matter are those of the model provider you connect. Because the project is no longer maintained, ask a second question too: who will fix a vulnerability found in the extension itself?

The difference between personal and business accounts is the same story as with chatbots; the AI at work privacy checklist covers it. If developers are already using personal accounts, start with shadow AI at work.

Which admin controls limit what AI coding assistants can see and do?

Each vendor offers a different kind of control. None of them does everything.

Content exclusion (GitHub Copilot). Repository admins, organisation owners and enterprise owners can list paths Copilot should ignore. Patterns use fnmatch syntax and are case insensitive, for example - "secrets.json" or - "/scripts/**". Changes can take "up to 30 minutes to take effect in IDEs where the settings are already loaded." The limit to note: "GitHub Copilot CLI and Agent mode in Copilot Chat in IDEs do not support content exclusion."

Permission modes and allowlists (Claude Code). Claude Code's permissions documentation describes modes from default (asks on first use of each tool) and plan (explores without editing your source files) to bypassPermissions, which skips prompts. Its warning on that last one: "Only use this mode in isolated environments like containers or VMs where Claude Code can't cause damage." You can write allow, ask and deny rules such as Read(./.env), and administrators can deploy managed settings "that user and project settings can't override".

Privacy Mode (Cursor). As above, an admin can switch it on for the whole team.

Public-code filter (GitHub Copilot). The "Suggestions matching public code" policy is set to Allowed by default for Copilot Business; admins change it in the Privacy section of the Copilot policy page. GitHub's code suggestions page says code referencing compares a suggestion and approximately 150 characters of surrounding code against public repositories, and matching suggestions "can be blocked or shown with information about the matching code." GitHub says matches typically occur in under 1% of suggestions. The FAQ ties the filter to IP indemnity, which covers "the unmodified suggestions when Copilot's filtering is enabled."

The general rule for agents that act on their own, giving them only the access the job needs, is in the guide to AI agents at work.

How do secrets end up in AI coding assistant prompts?

Usually by accident. A developer asks the assistant to fix a failing connection, and the assistant opens the config file that holds the database password. Or someone pastes a log that includes an API key.

Three habits reduce this:

  1. Block secret files from the assistant. In Claude Code, add a deny rule like Read(./.env) or Read(./secrets/**). Its docs say a .claudeignore file "has no effect". In Copilot, add the paths to content exclusion, remembering that agent mode and the CLI don't honour it.
  2. Remember the local copy. Claude Code stores session transcripts "locally in plaintext under ~/.claude/projects/ for 30 days by default", adjustable with cleanupPeriodDays. A secret pasted into a session stays on disk until then.
  3. Keep secrets out of repositories entirely. If the secret isn't in the code, the assistant can't read it, and it can't be pushed.

If a key does leak, rotation is the fix. The Hugging Face Spaces case file shows why practising rotation matters.

Why does AI-written code still need human review?

Because the assistant can be wrong, and because it can be steered. A model writes plausible code, not proven code. And an assistant that reads a README, an issue or a web page can pick up instructions planted there, which is prompt injection.

Claude Code's documentation makes a useful distinction: "Permission rules are enforced by Claude Code, not by the model. Instructions in your prompt or CLAUDE.md shape what Claude tries to do, but they don't change what Claude Code allows." The same thinking applies to code. Asking the AI to write secure code shapes what it tries. Review and repository rules decide what merges.

Treat AI-written code as code from a capable new contributor: welcome, and reviewed every time.

Which repository rules catch what an AI coding assistant misses?

On GitHub, two features do most of the work.

Rulesets. GitHub's available rules include:

  • Require a pull request before merging, with a set number of approving reviews, "Dismiss stale pull request approvals when new commits are pushed", review from Code Owners, and approval of the most recent reviewable push by someone other than the person who pushed it.
  • Require status checks to pass, so CI tests must pass first.
  • Require code scanning results, which blocks a merge when a required scanning tool finds an alert at the severity you set.
  • Block force pushes and Restrict deletions, both selected by default.

Secret scanning push protection. GitHub's push protection documentation describes it as blocking hardcoded credentials before they land. It covers command-line pushes, commits in the web UI, file uploads and REST API requests. Push protection for users is "enabled by default" for public repositories. Push protection for a repository "Requires GitHub Secret Protection to be enabled."

Going deeper: for security and IT teams

Trust boundaries. Each assistant crosses up to three: the model API (prompts, file contents, outputs), the vendor's own backend (Cursor documents requests to its backend domains; Claude Code documents metrics and error reports), and local execution, where an agent runs shell commands with the developer's privileges. The third boundary is where permission controls matter most.

Claude Code policy mechanics. Rules are evaluated "in order: deny, then ask, then allow. The first match in that order determines the outcome, and rule specificity doesn't change the order." A deny in any scope beats an allow in another. Managed settings sit highest: "no other level, including command line arguments, can override a managed permission rule." Three keys belong in your managed baseline:

  • permissions.disableBypassPermissionsMode and permissions.disableAutoMode, set to "disable".
  • allowManagedPermissionRulesOnly, which makes managed settings the only source of permission rules.
  • Read deny rules for secret paths. Deny rules also apply to symlink targets: "A symlink that points to a denied file is itself denied."

Know the limit: a Bash deny rule "doesn't match the same program by path or inside sh -c", so the docs advise pairing it with the sandbox network allowlist when a restriction must hold. For outbound traffic, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC turns off non-essential traffic, and the docs state metrics "never include your code, prompts, or file paths."

Copilot content exclusion as a control. Scope matters: enterprise rules apply to every Copilot user in the enterprise; organisation rules apply only to users with a seat from that organisation. Because the CLI and IDE agent mode don't honour exclusion, don't record it as a control for agentic use. Your compensating control is keeping secrets out of the working tree.

Repository controls against agent-authored changes. "Require approval of the most recent reviewable push" means someone other than the last pusher must approve. That stops an agent's final commit landing on an approval given to an earlier diff. Review the ruleset bypass list too: bypass can be granted to roles, teams or GitHub Apps, so an AI agent's app on that list skips every rule. For push protection, by default "anyone with write access to the repository can bypass push protection by specifying a bypass reason." Use delegated bypass if you want a reviewer in that loop.

In practice: secrets already leak at scale. GitGuardian's State of Secrets Sprawl 2025 (11 March 2025) reports "23.8 million secrets leaked on public GitHub repositories in 2024", a "25% year-over-year increase", and that "4.6% of all public repositories contain a secret." Private repositories are no safe harbour: it found "35% of private repositories contain secrets." An assistant that reads the working tree reads those too.

In practice: leaked secrets stay usable. The same report found "70% of secrets leaked in 2022 remain active today." Detection without rotation leaves the door open.

Detection and evidence. Each push-protection bypass creates an alert, an audit log entry and an email to owners. A bypass reason of "I'll fix it later" leaves an open alert; "It's used in tests" and "It's a false positive" create closed ones, so review closed alerts as well. Test controls directly: put a dummy secret in an excluded or denied file and confirm the assistant can't read or cite it.

What to ask vendors. Which surfaces (IDE, CLI, agent, cloud) does each control cover? What is retained, for how long, and does feedback or bug reporting change that? Can admins enforce settings that users can't override? For open-source tools, check the repository's maintenance status before rollout, and recheck it each year.

Learn more

Key takeaways

  • Anything an AI coding assistant can read, it can send to a model. Keep secrets out of what it can read.
  • Check each vendor's business data terms for training and retention, including feedback and bug-report paths. For an open-source tool, also check that it's still maintained.
  • Admin controls differ: content exclusion in Copilot, permission modes and managed settings in Claude Code, team Privacy Mode in Cursor. Check which surfaces each covers.
  • AI-written code goes through the same pull request review, status checks and code scanning as anyone else's.
  • Turn on secret scanning push protection and review who, including which apps, can bypass your rules.

Sources