Building with AI tools changes the security picture in three ways. Code and sometimes data are sent to AI services. AI agents can take actions in development environments and connected systems. And AI-generated code can introduce weaknesses at speed. None of this is a reason to avoid AI tools, but each needs clear controls.
Use this checklist when setting up an AI-accelerated project, or when reviewing a team that works this way. It pairs with how we review AI-generated code.
1. Know which AI services are used
- List every AI tool and service used on the project: coding assistants, agents, chat tools and APIs.
- Check that each is used under business or enterprise terms, not personal accounts.
- Confirm data retention and training terms for each, and record them.
- Agree with the client which services are approved, especially for regulated data.
2. Keep secrets out
- Store secrets in a secret manager or environment settings, never in code or prompts.
- Use secret scanning on repositories and block commits that contain keys.
- Keep configuration files with credentials out of what AI tools can read.
- Rotate any secret that has been exposed, even briefly.
3. Keep production data out
- Do not paste real customer data into AI tools during development.
- Use realistic but fake test data, or properly anonymized copies.
- Keep AI agents away from production databases during development.
- If an AI feature must process real data in production, use services approved for that data.
For the product side of this, read how to keep customer data safe when using AI.
4. Limit what AI agents can do
- Run coding agents with the permissions of a limited user, not an administrator.
- Require confirmation for commands that delete, deploy or change infrastructure.
- Scope repository access to the projects the agent needs.
- Log agent actions so they can be reviewed.
5. Control MCP servers and tools
Many AI tools connect to other systems through MCP servers. Each connection is a door into a system.
- Prefer official servers from vendors, and review community servers before use.
- Give each server the smallest access it needs, starting read-only.
- Use separate, scoped credentials for each server, never shared admin keys.
- Remove servers that are no longer used.
See MCP security best practices for more detail.
6. Review every change
- No AI-generated change merges without human review.
- Security-sensitive areas, such as authentication, permissions, payments and file handling, get a senior review.
- Check that access control happens on the server for every request.
- Watch for AI adding dependencies without need.
7. Check dependencies
AI tools sometimes suggest packages that are outdated, unmaintained or even non-existent names that attackers could register. Verify every new dependency: it exists, is maintained, is widely used and has an acceptable license. Use automated dependency scanning to catch known vulnerabilities.
8. Test for security
- Include tests for permissions: users must not reach data or actions outside their role or tenant.
- Run automated security scanning on code and dependencies.
- For important releases, do a focused security review or external test.
9. Secure AI features in the product
If the software you build includes AI, such as an assistant or an agent, add controls for AI-specific risks:
- Prompt injection. Treat user input and fetched content as untrusted. Do not let it override instructions or trigger sensitive actions.
- Tool permissions. Give the AI only the tools and data each user is allowed to use.
- Output validation. Check structured outputs in code before acting on them.
- Human approval. Require confirmation for actions that send messages, change records or move money.
- Logging. Record prompts, tool calls and outcomes for audit, with care for personal data.
See what are AI agents and how do businesses use them.
10. Manage people and access
- Give team members access only to what their role needs.
- Use company accounts for all AI tools and remove access when people leave.
- Require two-factor sign-in on repositories, hosting and AI tool accounts.
- Keep client repositories and accounts in the client's name. See user authentication.
11. Plan for incidents
Agree in advance what happens if a secret leaks, an agent does something unexpected or a vulnerability is found: who is told, how credentials are rotated and how affected users are informed. A short written plan turns a stressful event into a routine one.
One-page summary
- Approved AI services listed with their data terms.
- Secrets in a secret manager, scanned for in code.
- No production customer data in development AI tools.
- Agents and MCP servers with least access and logs.
- Human review for every change, senior review for sensitive code.
- Dependencies verified and scanned.
- Permission tests and security scanning in the pipeline.
- AI features protected against injection, with approvals and logs.
- Company accounts, two-factor sign-in and an incident plan.
Keep it proportionate
Not every project needs the heaviest controls. A marketing site with no personal data needs far less than a healthcare portal. Use this checklist to decide what applies, write down the decisions and review them when the project changes. Proportionate, written controls are more effective than a long policy nobody follows.
Questions clients should ask
If you are hiring a team that builds with AI, ask them to walk you through this checklist for your project. Which AI services will see your code, and under which terms? Where are secrets stored? Can AI agents reach your production systems, and if so, with what permissions? Who reviews security-sensitive code? What happens if a secret leaks? A team with good practices answers these quickly and specifically, and is happy to put the answers in writing.
You can also ask to see the settings: repository protections, secret scanning results and the list of connected tools. Transparency here is a good sign of transparency elsewhere.
Keeping it current
AI tools change quickly, and so do their terms and capabilities. Review the list of approved services and connected tools every few months, remove what is no longer used and check for new features that change the risk, such as an agent gaining the ability to run commands or reach the internet. Treat security as part of regular project work, not a one-time setup, and record each review so it is clear what was checked and when.
For small teams
Small teams often worry that security controls will slow them down. The most important ones take little time: company accounts for AI tools, a secret manager, two-factor sign-in, review before merging and read-only access by default for agents and MCP servers. Start with those, write them down in a page, and add more as the product and its data grow.