Core Policy, Risks, and Security Boundaries

The Danger of 'Vibe Coding'

In a fast-paced engineering environment, we often fall into a state called 'vibe coding.' This is when you are rapidly iterating, prompting an AI, and pasting code back and forth to squash a bug. The primary risk here is unintentional data leakage. When you're in 'the zone,' it is incredibly easy to paste sensitive logs or environment variables without a second thought.

The Error Log Trap

Imagine you are debugging a failed API call. You copy the entire stack trace from your terminal to ask the AI for help. But look closely: you've just sent a Production JWT, a Session ID, and customer PII to an external provider. Once that data hits a third-party LLM, it is no longer under our control and may be used to train future models.

Security Boundaries

We categorize AI tools into two tiers. Approved Internal Tools, like our Enterprise Copilot or VPC-hosted models, guarantee your data isn't used for training. Restricted Third-Party APIs, however, are high-risk. Usage of these for proprietary code or customer data is strictly prohibited because your input may be reviewed by human contractors.

Defining Sensitive Data

Before sending any snippet, it must be cleared of the 'Big Four.' First, Secrets and Credentials like database connection strings. Second, PII such as real names or IP addresses. Third, Protected Health Information. And finally, Proprietary Logic—the unique algorithms that give us our competitive edge.

Spot the Vulnerability

Here is a JSON payload you might want to optimize. Click on every line that contains sensitive data that should never be sent to an external AI. Excellent work. You identified the email, the internal IP, and the session token. These must be replaced with placeholders before prompting. Not quite. That line is generic structure and safe to share. Correct. That line contains sensitive data.

The 'Pre-Flight' Check

Before you hit 'Send,' follow this quick mental checklist. First, is this an approved tool? Second, check for hardcoded tokens or internal URLs. Third, only paste the necessary logic, not surrounding files. Finally, for large logs, use tools like Microsoft Presidio or our internal proxies to scrub data automatically.

Key Takeaways

Let's recap the core policy. High-speed iteration increases the likelihood of slips. Always know if your tool is Internal or External. Sanitize every snippet with placeholders, and remember that error logs are the most common source of leaks.