Before rolling out an AI coding assistant, test five areas: what data leaves your environment, how good and safe the output is, what an agent may do on its own, what it pulls into your supply chain, and what you can log and audit. Score each with evidence from a pilot, not with vendor claims.
What should the checklist cover?
OWASP's 2025 Top 10 for LLM applications gives a reasonable frame. It lists prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. NIST's Secure Software Development Framework adds the reminder that secure practices have to be integrated into every software development lifecycle, and that producers should reduce vulnerabilities in what they release. Together they point at the five areas below.
1. Data handling
Ask what leaves the machine: open files, whole repositories, terminal output, environment variables. Find out whether prompts are retained, for how long, and whether they are used for training, and read the contract, not the marketing page. Test with a canary secret in a scratch repository and see whether it appears in any transmitted context or log you can inspect. This maps to sensitive information disclosure.
2. Output quality and safety
Run a fixed set of tasks drawn from your own codebase: a query builder, a file upload handler, an auth check. Review the results as you would a junior developer's pull request. Look for string concatenated queries, missing authorization, unsafe deserialization and invented package names. OWASP's improper output handling and misinformation entries both apply: generated code is untrusted input until reviewed and tested.
Constructed example: during a pilot, an assistant suggests a helper package that does not exist on the registry. A malicious actor could register that name later and wait. The team adds a rule that any new dependency in a pull request must come from an approved registry and pass a dependency scan, whether a human or an assistant added it.
3. Agency and permissions
Modern assistants run commands, edit many files and call tools. Excessive agency is its own OWASP entry. Check what the agent can execute without approval, whether commands run in a sandbox, whether it can reach production credentials, and how tool servers are approved. Default to read access and explicit approval for writes and shell commands. Treat any content the agent reads, such as issues, web pages or documents, as possibly hostile instructions.
4. Supply chain
You are adding a vendor, plugins, extensions and possibly model providers. Ask for the vendor's own security reporting process, how extensions are reviewed and how updates are delivered. Pin versions of extensions in managed environments and keep an inventory of which developers have which tools.
5. Logging and control
You need to know who used which assistant on which repository, and ideally what tools it called. Check admin controls: can you disable it per repository, enforce settings centrally, export audit logs and revoke access fast? Set cost and rate limits, since unbounded consumption can turn into a bill or an outage.
Where does Safeguard fit?
Safeguard offers IDE extensions for VS Code, Open VSX compatible editors such as Cursor and JetBrains, which show security insight while you code, and an MCP server and MCP Guardrail for controlling how agents call tools. They complement your assistant review and do not replace it.
How to apply this
- Pick a pilot group and two repositories, one of them low sensitivity.
- Run the canary secret test and record the result.
- Run your fixed task set and review outputs against your secure coding standard.
- Set agent permissions to approve before write and run, and test the boundaries.
- Require dependency scanning on every pull request regardless of author.
- Collect logs for two weeks and check you can answer who did what.
- Decide on rollout only after reviewing the evidence with security and legal.
Quick check
Is AI generated code safer if it passes my tests?
Not necessarily. Tests cover the behavior you thought of. Review for security properties such as authorization, input handling and dependencies, and scan the result.
What is the first thing to test?
What data leaves the machine. A canary secret in a scratch repository is a quick and concrete test.
Sources
- OWASP Top 10 for LLM Applications 2025
- NIST SP 800-218: Secure Software Development Framework
- NIST: AI Risk Management Framework
Last reviewed: 18 October 2026.
