AI code-gen tools have shifted from assistant to teammate. They read your codebase, suggest changes, run tests, commit code. The security model has not caught up. This module covers the practical risks and the team-level controls.
Code-context exfiltration via cloud LLM
Copilot, Cursor, Claude Code by default send your file context (selected file + nearby files + symbol references) to the vendor cloud. For closed-source / sensitive codebases, this is data exfiltration to a third party — DPDP issue if the code includes processed personal data, IP issue regardless. Mitigations: (1) self-hosted alternatives — Continue.dev with Ollama, Tabby, Cody Enterprise on-prem. (2) Vendor-side enterprise tiers — GitHub Copilot Enterprise has zero-retention contractual guarantees; OpenAI Enterprise excludes data from training. (3) Code masking — replace sensitive patterns (API keys, internal hostnames) with placeholders before sending. Most teams accept the cloud risk for productivity gains; document the choice in your data-flow inventory for DPDP audit.
Book a free 30-minute scoping call
Our senior consultants will review your stack and tell you honestly what to fix first. No slide deck. No obligation. Indian businesses only.