Skip to content
Playbook

AI Coding Assistants

Related: GitHub, Secrets Management, Input Validation

Most of us use Claude (including Claude Code in the terminal and editor), and some have a GitHub Copilot license. AI assistants can speed up a lot of work, including security work. They can also confidently produce insecure code, suggest packages that don’t exist, or send things to the model that shouldn’t leave your machine. This page covers both sides.

Using AI assistants safely

Section titled “Using AI assistants safely”
  • You own the code. Review AI-generated code with the same care as code from a colleague, and more around authentication, authorization, input handling, cryptography and anything that builds SQL, shell commands or HTML.
  • Check new dependencies. Assistants sometimes suggest packages that don’t exist or are lookalikes of popular ones (so-called slopsquatting). Verify that a suggested package is the one you think it is before installing it, and follow Adding a new dependency.
  • Keep secrets out of prompts. Don’t paste credentials, tokens, .env contents or customer data into a chat. Agents that read files can pick up .env files on their own, so keep real secrets out of the working directory where you can, or deny access to them (see below).
  • Be careful with agents that run commands. Agents can run shell commands, install packages and edit many files at once. Read what the agent wants to run before approving it, don’t auto-approve broad commands, and don’t give it tokens with more access than the task needs.
  • Treat external content as untrusted. Issues, PR descriptions, web pages and dependency READMEs can contain instructions aimed at the assistant (prompt injection). Be skeptical when an agent’s behavior changes after reading external content.

Restricting what the assistant can access

Section titled “Restricting what the assistant can access”
  • Claude Code: use permission settings in .claude/settings.json to deny reading files like .env* and to control which commands need approval.
  • GitHub Copilot: use content exclusion for files Copilot shouldn’t read.

Using AI assistants for security

Section titled “Using AI assistants for security”

We don’t have automated code scanning on private repositories (see GitHub Advanced Security), so an AI security review is a useful extra pass on sensitive changes. It doesn’t replace review from a person.

Security reviews and threat modeling

Section titled “Security reviews and threat modeling”

In Claude Code, run /security-review to have Claude review the pending changes on your branch for security issues before you open a pull request.

You can also ask any assistant directly, for example:

  • “Review this diff for security issues: injection, missing authorization checks, secrets and unsafe input handling.”
  • “Make a threat model of this service using STRIDE. List trust boundaries, threats and concrete mitigations.”
  • “Which of these API endpoints are missing authorization checks?”

Use the result as a starting point for discussion with the team, not as a conclusion. Verify each finding before acting on it.

Copilot code review

Section titled “Copilot code review”

If you have a Copilot license, you can request Copilot code review as a reviewer on a pull request. It’s useful as an extra pass that catches obvious issues.

Project instructions and skills

Section titled “Project instructions and skills”

Give the assistant our conventions so its suggestions match how we actually work, e.g. the stack, how auth is done and the guidelines in this playbook:

Shared agent skills live in tryhuset/agent-skills, for example the Backstage skill for generating catalog entries.