Shadow AI coding tools: a CISO checklist

Shadow AI for coding is usually not a rogue SaaS buried in marketing. It is Cursor on a laptop, Claude Code in a terminal, Copilot in VS Code, and Gemini CLI on a build machine — often adopted before security has an inventory.

This checklist is for CISOs and security engineering leads who need visibility and controls without blocking developer velocity.

1. Inventory the tools that actually touch code

List assistants and paths in use today:

| Tool | Typical surface | Capture / control notes | | --- | --- | --- | | Cursor | IDE + agent tools | File reads, terminal, Privacy Mode ≠ redaction | | Claude Code | CLI agent loops | Hooks can intercept tool I/O | | GitHub Copilot | IDE + cloud | Often gateway / OTEL for org logging | | Gemini CLI / other CLIs | Terminal agents | Hook or proxy coverage varies | | ChatGPT / Claude.ai | Browser | Different boundary than IDE hooks |

Ask engineering leads which tools are approved, which are tolerated, and which are unknown. Pair the list with security & compliance requirements for your org.

2. Decide the control plane per tool

Not every assistant exposes the same interception points. A practical split:

• Native hooks — Cursor, Claude Code, and similar CLIs where pre-execution DLP can redact .env and shell secrets (AI coding assistant DLP)
• Gateway / OTEL — channels where provider credentials and request logs live centrally
• Browser capture — ChatGPT-class workflows that never hit IDE hooks

Document which layer covers each tool so “we have Copilot enterprise” is not mistaken for “Cursor is controlled.”

3. Evidence for SOC 2-style programs

ReclaimLLM’s public compliance posture: SOC 2 is a target (Q4 2026), not a completed certification. Use product evidence that exists today rather than inventing audit language:

• Session and tool-level records suitable for review
• Local hook redaction configuration and substitution sync (rclm-update)
• Org gateway logging where the enterprise gateway is deployed
• Anomaly detectors such as sensitive-file access patterns documented at enterprise anomalies

Map controls to your auditor’s existing criteria (access, change management, monitoring). Do not claim “SOC 2 certified” until the report is issued. See the compliance hub for current regulatory mappings.

4. PIPEDA and Québec Law 25 — accurate notes only

Canadian privacy frameworks care about purpose limitation, safeguarding, and accountability for personal information. AI coding tools can process:

• Employee identifiers in paths and prompts
• Customer data accidentally pulled into context
• Credentials that unlock systems holding personal information

Controls that help a privacy program (without overclaiming legal advice):

• Minimize what leaves the workstation (hook redaction, folder capture filters) — sensitive data docs
• Prefer regional residency or private VPC when contracts require isolation
• Keep an inventory of processors (model providers) per tool

Treat PIPEDA / Law 25 as lawyer-led interpretations of your data flows; product pages describe technical safeguards, not a certification of compliance.

5. Operating checklist

1. Named owner for AI coding tool inventory (security + eng)
2. Approved vs provisional tool list, reviewed quarterly
3. Hook install coverage for Cursor / Claude Code where used (install)
4. Redaction rules for env files and high-entropy secrets
5. Gateway or equivalent logging for Copilot / API paths
6. Share/export review process for sessions that may contain sensitive content
7. Link to DLP governance for the technical stack

Shadow AI shrinks when inventory, interception, and evidence are explicit — not when ignore files are mistaken for DLP.