影子 AI 編碼工具：CISO 檢查清單

Shadow AI for coding is usually not a rogue SaaS buried in marketing. It is Cursor on a laptop, Claude Code in a terminal, Copilot in VS Code, and Gemini CLI on a build machine — often adopted before security has an inventory.

This checklist is for CISOs and security engineering leads who need visibility and controls without blocking developer velocity.

1. Inventory the tools that actually touch code

List assistants and paths in use today:

Tool	Typical surface	Capture / control notes
Cursor	IDE + agent tools	File reads, terminal, Privacy Mode ≠ redaction
Claude Code	CLI agent loops	Hooks can intercept tool I/O
GitHub Copilot	IDE + cloud	Often gateway / OTEL for org logging
Gemini CLI / other CLIs	Terminal agents	Hook or proxy coverage varies
ChatGPT / Claude.ai	Browser	Different boundary than IDE hooks

Ask engineering leads which tools are approved, which are tolerated, and which are unknown. Pair the list with security & compliance requirements for your org.

2. Decide the control plane per tool

Not every assistant exposes the same interception points. A practical split:

Native hooks — Cursor, Claude Code, and similar CLIs where pre-execution DLP can redact .env and shell secrets (AI coding assistant DLP)
Gateway / OTEL — channels where provider credentials and request logs live centrally
Browser capture — ChatGPT-class workflows that never hit IDE hooks

Document which layer covers each tool so “we have Copilot enterprise” is not mistaken for “Cursor is controlled.”

3. Evidence for SOC 2-style programs

ReclaimLLM’s public compliance posture: SOC 2 is a target (Q4 2026), not a completed certification. Use product evidence that exists today rather than inventing audit language:

Session and tool-level records suitable for review
Local hook redaction configuration and substitution sync (rclm-update)
Org gateway logging where the enterprise gateway is deployed
Anomaly detectors such as sensitive-file access patterns documented at enterprise anomalies

Map controls to your auditor’s existing criteria (access, change management, monitoring). Do not claim “SOC 2 certified” until the report is issued. See the compliance hub for current regulatory mappings.

4. PIPEDA and Québec Law 25 — accurate notes only

Canadian privacy frameworks care about purpose limitation, safeguarding, and accountability for personal information. AI coding tools can process:

Employee identifiers in paths and prompts
Customer data accidentally pulled into context
Credentials that unlock systems holding personal information

Controls that help a privacy program (without overclaiming legal advice):

Minimize what leaves the workstation (hook redaction, folder capture filters) — sensitive data docs
Prefer regional residency or private VPC when contracts require isolation
Keep an inventory of processors (model providers) per tool

Treat PIPEDA / Law 25 as lawyer-led interpretations of your data flows; product pages describe technical safeguards, not a certification of compliance.

5. Operating checklist

Named owner for AI coding tool inventory (security + eng)
Approved vs provisional tool list, reviewed quarterly
Hook install coverage for Cursor / Claude Code where used (install)
Redaction rules for env files and high-entropy secrets
Gateway or equivalent logging for Copilot / API paths
Share/export review process for sessions that may contain sensitive content
Link to DLP governance for the technical stack

Shadow AI shrinks when inventory, interception, and evidence are explicit — not when ignore files are mistaken for DLP.