Guideline
AI Coding Assistant Security Guideline
This guideline defines requirements and best practices for the secure use of AI coding assistants, tools such as Claude Code, GitHub Copilot, Cursor, Windsurf, and equivalent products, within the software development lifecycle.
- Type
- Guideline
- Version
- 1.3.23
- Date
- 2026-10-22
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Developer Security
- Review frequency
- 6 to 12 months and upon material change to AI coding tooling, threat landscape, or regulatory guidance
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Approved tools and authorization
- Required security configuration
- Data handling requirements
- Code review requirements for AI-generated code
- Prohibited uses
- Prompt injection awareness
- Defensive scanning of AI coding assistant inputs and outputs
- Session isolation, vendor telemetry, and egress monitoring for AI coding assistants
- Agentic use (multi-step autonomous coding)
- Incident reporting
- External reference sources
- Framework alignment
Frameworks it maps to
Related documents
- Developer Security Requirementsdev-security
- guardrails/
README.md (opens in a new tab) source - Security Baseline and Standards Referencedev-security
- AI and Agentic Development Security Standardai
- AI Security and Risk Standardai
- Exception and Risk Acceptance Management Policygovernance
Next
All Documents