Acceptance criteria
Identify source code exposure across browser, IDE, desktop, CLI and agent workflows.
Why it matters
Source code is pasted into AI tools daily, across more surfaces than any other data type.
How to verify
Proprietary code is detected in browser, IDE, CLI and agent use by pilot users.
OWASP adoption context
Source code and engineering material can move through assistants, platforms and agent workflows as well as shadow tools; protection should follow the content.
Framework mappings
Code-exposure findings across browser, IDE, desktop, CLI and agent paths supply runtime-monitoring and in-transit protection inputs. Demonstrated detection coverage does not imply every transfer is stopped.
Source-code detection informs planned disclosure-risk responses and responsible-use rules across AI channels. The buyer still needs to select and operate the response.
Identifying exposure of code designated confidential supplies inputs to confidentiality and leakage controls. It does not establish ownership, licensing compliance, repository access management or enforced prevention. SOC 2: C1.1: The Confidentiality category and relevant information must be in scope. ISO/IEC 27001: A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response.
Detecting source-code exposure supplies a specific input to responsible AI-use procedures across the supported channels. This link requires documented prohibited-input rules and an operated disposition; detection alone does not select or implement the response.