{"id":2004,"date":"2024-09-30T21:10:23","date_gmt":"2024-09-30T21:10:23","guid":{"rendered":"https:\/\/grokkingdev.com\/?p=2004"},"modified":"2024-10-01T00:00:41","modified_gmt":"2024-10-01T00:00:41","slug":"security-considerations-when-using-ai-coding-tools","status":"publish","type":"post","link":"https:\/\/grokkingdev.com\/index.php\/2024\/09\/30\/security-considerations-when-using-ai-coding-tools\/","title":{"rendered":"Security Considerations When Using AI Coding Tools"},"content":{"rendered":"\n<p>2024-09-31<\/p>\n\n\n\n<p>More and more developers are using AI coding assistant tools like GitHub Copilot to speed up development. These can be powerful tools for improving productivity. However, keep in mind that when integrated into an IDE, tools like Copilot potentially have access to all the source code the developer is working on. They don&#8217;t just have access to the code you paste into the prompts, they also use the contents of the current file to provide additional context for the prompts. This greatly improves the accuracy of the response, but also increases the amount of code shared with the LLM and may include sensitive data that isn&#8217;t visible in your code editor at the current time. For continuity and context, they also save this information for an unspecified length of time, so it&#8217;s important to read the data privacy agreement for the supplier so you fully understand how they&#8217;ll use your data and how long they&#8217;ll keep it.<\/p>\n\n\n\n<p>Here are some steps you should consider to prevent software secrets (such as API keys, credentials, or other sensitive data) from being sent to Large Language Models (LLMs) and possibly being used to train future versions:<\/p>\n\n\n\n<p><strong>Use an AI Assistant From A Trusted Company<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>It&#8217;s the wild west out there and new world-changing AI assistants are popping up everywhere. Those located in the US and the EU have much stronger &#8211; and enforceable laws and regulations concerning privacy. Make sure you feel comfortable that the company will honor its privacy agreement.<\/li>\n<\/ul>\n\n\n\n<p><strong>Choose A Plan Or Configure Your Plan So It Doesn&#8217;t Use Your Prompts and Code To Train Its Models<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>GitHub does not use either Copilot Business or Enterprise data to train its models.<\/li>\n\n\n\n<li>GitHub&#8217;s Individual Plan does allow your data to be used to train its models. Turn this off by logging into your GitHub account, access Settings, Copilot and deselect &#8220;Allow GitHub to use my code snippets from the code editor for product improvements&#8221;.<\/li>\n<\/ul>\n\n\n\n<p><strong>Use Environment Variables for Secrets<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Never hard-code secrets<\/strong> directly into your source code. Instead, use environment variables or configuration management tools to inject secrets at runtime.<\/li>\n\n\n\n<li>This reduces the risk of accidentally exposing secrets, as they are not present in the code files that might be shared with or processed by AI coding assistants.<\/li>\n<\/ul>\n\n\n\n<p><strong>Use Secret Management Tools<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Employ secret management tools such as <strong>AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault<\/strong> to securely manage and access sensitive information. These tools store secrets securely and can be integrated into your development workflow. More importantly, by using these tools, you&#8217;ll never expose your secrets to either your repository or to AI assistants.<\/li>\n<\/ul>\n\n\n\n<p><strong>Leverage .gitignore and .copilotignore<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keys and secrets should never be committed to your version control system.<\/li>\n\n\n\n<li>Use a .gitignore file to exclude sensitive files (e.g., config.yaml, .env) from being included in your Git repository.<\/li>\n\n\n\n<li>GitHub Copilot supports the use of .copilotignore to specify files or directories that should be excluded from Copilot\u2019s context. Make sure to add any files containing secrets or any other potentially sensitive data to this file to prevent them from being processed.<\/li>\n\n\n\n<li>Check to see if your current coding companion has similar functionality.<\/li>\n<\/ul>\n\n\n\n<p><strong>Implement Access Control Policies<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Limit access to secrets by following the <strong>Principle of Least Privilege (PoLP)<\/strong>. Only allow team members or applications that require access to specific secrets to have permissions.<\/li>\n\n\n\n<li>Ensure that you have robust access controls on your version control repositories, reducing the likelihood of accidental exposure.<\/li>\n\n\n\n<li>Remember, if they can&#8217;t access it, they can&#8217;t share it.<\/li>\n<\/ul>\n\n\n\n<p><strong>Use Linting and Static Analysis Tools<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Utilize tools like <strong>TruffleHog, GitLeaks, or SpectralOps<\/strong> to scan your source code for potential secrets and other sensitive data. These tools can detect secrets before they are committed to your repository, preventing accidental exposure.<\/li>\n\n\n\n<li>This is especially important for large\/old code bases and those that have been added when acquiring another company.<\/li>\n<\/ul>\n\n\n\n<p><strong>Review and Monitor Copilot Suggestions<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Carefully review the suggestions made by Copilot, as it might inadvertently generate code that includes secrets or other sensitive information. Developers should be vigilant and ensure that any suggestions are free of sensitive data.<\/li>\n<\/ul>\n\n\n\n<p><strong>Train Developers on Secure Coding Practices<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Regularly train developers on secure coding practices, emphasizing the importance of not including sensitive information in code and using secure methods for managing secrets.<\/li>\n<\/ul>\n\n\n\n<p><strong>Regularly Rotate Secrets<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Implement a process to regularly rotate keys, passwords, and tokens to minimize the impact of accidental exposure.<\/li>\n<\/ul>\n\n\n\n<p><strong>Disable Copilot in Sensitive Repositories<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\"><\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li>For projects where security is a top priority or where sensitive data is frequently handled, consider disabling Copilot entirely or restricting its usage to non-sensitive parts of the project.<\/li>\n<\/ul>\n\n\n\n<p>By following these best practices, developers can significantly reduce the risk of exposing sensitive information to tools like GitHub Copilot and other LLM-based coding assistants.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>2024-09-31 More and more developers are using AI coding assistant tools like GitHub Copilot to speed up development. These can be powerful tools for improving productivity. However, keep in mind [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","_jetpack_memberships_contains_paid_content":false,"ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[18],"tags":[12,15,17,16,14,13],"class_list":["post-2004","post","type-post","status-publish","format-standard","hentry","category-ai-ml","tag-ai","tag-coding-assistant","tag-developing","tag-llm","tag-privacy","tag-security","entry"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/grokkingdev.com\/index.php\/wp-json\/wp\/v2\/posts\/2004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/grokkingdev.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/grokkingdev.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/grokkingdev.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/grokkingdev.com\/index.php\/wp-json\/wp\/v2\/comments?post=2004"}],"version-history":[{"count":4,"href":"https:\/\/grokkingdev.com\/index.php\/wp-json\/wp\/v2\/posts\/2004\/revisions"}],"predecessor-version":[{"id":2009,"href":"https:\/\/grokkingdev.com\/index.php\/wp-json\/wp\/v2\/posts\/2004\/revisions\/2009"}],"wp:attachment":[{"href":"https:\/\/grokkingdev.com\/index.php\/wp-json\/wp\/v2\/media?parent=2004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/grokkingdev.com\/index.php\/wp-json\/wp\/v2\/categories?post=2004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/grokkingdev.com\/index.php\/wp-json\/wp\/v2\/tags?post=2004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}