Code Generation Security

How a developer platform secured AI code completion and refactoring at scale without slowing teams down.

Challenge

An engineering organization rolled out an AI coding assistant to:

Generate boilerplate and tests
Refactor legacy services
Draft infrastructure changes

Critical Requirements

Block insecure code patterns (RCE, SSRF, deserialization)
Prevent secret leakage in prompts and outputs
Ensure generated code respects internal policies
Maintain developer velocity

Solution

KoreShield scanned both prompts and model outputs. Suspicious requests were blocked, and risky outputs were flagged for review.

import { Koreshield } from 'koreshield-sdk';

const koreshield = new Koreshield({
  apiKey: process.env.KORESHIELD_API_KEY,
  sensitivity: 'high',
});

async function secureCodeGen(request: string) {
  const inputScan = await koreshield.scan({
    content: request,
    metadata: { domain: 'code-gen', repo: 'core-platform' },
  });

  if (inputScan.threat_detected) {
    return { error: 'Blocked unsafe request' };
  }

  const output = await generateCode(request);

  const outputScan = await koreshield.scan({
    content: output,
    metadata: { domain: 'code-gen', output: true },
  });

  if (outputScan.threat_detected) {
    return { error: 'Generated code failed security checks' };
  }

  return { output };
}

Threat Model

The security team focused on:

Prompt Injection

Requests for secrets or internal code

Unsafe Patterns

Command injection, SSRF, crypto misuse

Licensing Violations

Code snippets with incompatible licenses

Data Exfiltration

Scripts that leak data to external endpoints

Secure-by-Default Controls

Secret Redaction

Removed API keys and tokens before logging or processing

Unsafe Pattern Checks

Blocked code with known exploit signatures (SQL injection, command execution)

Policy Scopes

Enforced repo-specific constraints and security requirements

Review Gates

Flagged high-risk outputs for security review before merge

CI and Developer Workflow

Pre-Commit Checks
IDE Integration
Sandbox Execution

Optional scan on generated diffs before commit

# .git/hooks/pre-commit
koreshield scan --diff

Warnings inline for risky suggestions

// Warning: Potential SQL injection
const query = `SELECT * FROM users WHERE id = ${userId}`;

Generated code executed in isolated test runners

# .github/workflows/test.yml
- name: Run in sandbox
  run: docker run --rm --network=none test-runner

Example: Detecting Unsafe Code

// KoreShield blocks this pattern
const file = req.query.filename;
exec(`cat ${file}`); // ❌ Command injection risk

Results

Fewer Vulnerabilities

Reduced vulnerable code suggestions in production repos

Low Latency

Maintained code-assist latency targets with minimal overhead

Audit Trail

Centralized audit trail for compliance and change control

Lessons Learned

Key Insights

Output scanning is critical for guarding against novel exploit patterns
Keeping policies repo-specific improves developer trust
Review gates should be rare and explainable to avoid friction
False positives hurt adoption - tune aggressively based on feedback

Best Practices

Scan Both Inputs and Outputs

While input scanning catches malicious prompts, output scanning is essential for detecting vulnerabilities in generated code that may slip through.

Context-Aware Policies

Different repos have different risk profiles. A startup’s internal tool needs different policies than a payment processing service.

Fast Feedback Loops

Integrate scanning into the IDE and CI/CD pipeline so developers get immediate feedback, not days later in security review.

Attack Detection

Learn about threat patterns

Security

Security best practices

Configuration

Configure policies

Use Cases

Code Generation Security

Code Generation Security

Challenge

Solution

Threat Model

Prompt Injection

Unsafe Patterns

Licensing Violations

Data Exfiltration

Secure-by-Default Controls

CI and Developer Workflow

Example: Detecting Unsafe Code

Results

Fewer Vulnerabilities

Low Latency

Audit Trail

Lessons Learned

Best Practices

Attack Detection

Security

Configuration

Build docs developers (and LLMs) love

Use Cases

​Code Generation Security

​Challenge

​Solution

​Threat Model

Prompt Injection

Unsafe Patterns

Licensing Violations

Data Exfiltration

​Secure-by-Default Controls

​CI and Developer Workflow

​Example: Detecting Unsafe Code

​Results

Fewer Vulnerabilities

Low Latency

Audit Trail

​Lessons Learned

​Best Practices

​Related Documentation

Attack Detection

Security

Configuration

Build docs developers (and LLMs) love

Code Generation Security

Challenge

Solution

Threat Model

Secure-by-Default Controls

CI and Developer Workflow

Example: Detecting Unsafe Code

Results

Lessons Learned

Best Practices

Related Documentation