Setting Up Secure AI Development Workflows

1.1 Configure AI Tool Security Settings

For GitHub Copilot:

// .github/copilot-config.yml
version: 1
suggestion_settings:
  languages:
    "*":
      disabled_for_file_patterns:
        - "**/auth/**"       # No AI in authentication
        - "**/payment/**"    # No AI in payment processing
        - "**/crypto/**"     # No AI for cryptography
        - "**/*secret*"      # No AI for secrets
        - "**/*key*"         # No AI for key management

For Cursor:

// .cursor/settings.json
{
  "ai.security": {
    "blockPatterns": [
      "password",
      "secret",
      "token",
      "api_key",
      "private_key"
    ],
    "requireReview": [
      "database queries",
      "file operations",
      "network requests"
    ]
  }
}

1.2 Create Security Context Files

Help AI understand your security requirements:

// SECURITY_CONTEXT.md
# Security Requirements for AI Code Generation

## Authentication
- Use OAuth 2.0 with PKCE flow
- Never store passwords in plain text
- Sessions expire after 30 minutes of inactivity

## Data Handling
- All PII must be encrypted at rest (AES-256)
- Use parameterized queries exclusively
- Log user actions, never user data

## API Security
- Rate limit: 100 requests per minute per user
- All endpoints require authentication
- Input validation on all user data

## Dependencies
- Only use packages from approved list
- No packages with known vulnerabilities
- Scan before adding any new dependency

2.1 IDE Security Extensions

Install these VS Code extensions:

# Required security extensions
code --install-extension snyk.snyk-vulnerability-scanner
code --install-extension trufflehog.trufflehog-scanner
code --install-extension sonarqube.sonarqube

Configure for AI code detection:

// .vscode/settings.json
{
  "snyk.ai-generated": {
    "enableEnhancedScanning": true,
    "autoScanOnSuggestionAccept": true
  },
  "editor.formatOnSave": true,
  "files.insertFinalNewline": true,
  "security.workspace.trust.enabled": true
}

2.2 Git Pre-commit Hooks

Catch vulnerabilities before they enter your repository:

#!/bin/bash
# .git/hooks/pre-commit

# Check for AI-generated code markers
if git diff --cached --name-only | xargs grep -l "@ai-generated|@cursor|@copilot" > /dev/null; then
  echo "🤖 AI-generated code detected. Running security checks..."
  
  # Run security linter
  npm run security:lint || exit 1
  
  # Check for common AI vulnerabilities
  npm run ai:security-check || exit 1
  
  # Scan for secrets
  trufflehog git file://. --since-commit HEAD --fail || exit 1
  
  echo "✅ Security checks passed"
fi

2.3 Custom AI Security Linter

Create rules specific to AI-generated code patterns:

// eslint-plugin-ai-security/rules/no-string-concat-queries.js
module.exports = {
  meta: {
    type: 'problem',
    docs: {
      description: 'Disallow string concatenation in database queries',
      category: 'Security',
      recommended: true
    }
  },
  create(context) {
    return {
      TemplateLiteral(node) {
        const code = context.getSourceCode().getText(node);
        if (code.match(/SELECT|INSERT|UPDATE|DELETE/i) && 
            node.expressions.length > 0) {
          context.report({
            node,
            message: 'Use parameterized queries instead of string concatenation'
          });
        }
      }
    };
  }
};

3.1 Automated PR Checks

# .github/workflows/ai-security-review.yml
name: AI Security Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  ai-security-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Detect AI-generated code
        run: |
          if grep -r "@ai-generated|@cursor|@copilot" .; then
            echo "ai_code_detected=true" >> $GITHUB_ENV
          fi
      
      - name: Enhanced security scan for AI code
        if: env.ai_code_detected == 'true'
        run: |
          # Run specialized AI vulnerability scanner
          npx shamans-cli scan --ai-mode --strict
          
      - name: Comment PR with security report
        uses: actions/github-script@v6
        with:
          script: |
            const report = require('./security-report.json');
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## 🔒 AI Security Review
${report.summary}`
            });

3.2 Manual Review Checklist

4.1 Runtime Security Monitoring

Track AI-generated code behavior in production:

// middleware/ai-code-monitor.js
const aiCodeMonitor = (req, res, next) => {
  const startTime = Date.now();
  
  // Wrap response to monitor AI code behavior
  const originalJson = res.json;
  res.json = function(data) {
    const duration = Date.now() - startTime;
    
    // Log suspicious patterns from AI code
    if (req.aiGenerated) {
      monitor.track({
        type: 'ai_code_execution',
        endpoint: req.path,
        duration,
        statusCode: res.statusCode,
        // Track potential security issues
        sqlQueries: req.sqlQueryCount || 0,
        externalApiCalls: req.externalApiCount || 0,
        filesAccessed: req.fileAccessCount || 0
      });
      
      // Alert on anomalies
      if (duration > 1000 || req.sqlQueryCount > 10) {
        alerting.warn('AI code performance issue', {
          endpoint: req.path,
          metrics: { duration, queries: req.sqlQueryCount }
        });
      }
    }
    
    return originalJson.call(this, data);
  };
  
  next();
};

4.2 Security Metrics Dashboard

Track AI code security metrics:

• • Percentage of code that's AI-generated
• • Vulnerabilities per 1000 lines of AI code
• • Mean time to detect AI vulnerabilities
• • Security incidents from AI code
• • Cost savings from early detection