# GRD-009: Detect proprietary source code and engineering content


- Area: Runtime Guardrails

- Verification: Live test
- OWASP adoption tier: AT0–AT4
- Formerly: DAT-013
- URL: /r/GRD-009

**Acceptance criteria:** Identify source code exposure across browser, IDE, desktop, CLI and agent workflows.

**Why it matters:** Source code is pasted into AI tools daily, across more surfaces than any other data type.

**How to verify:** Proprietary code is detected in browser, IDE, CLI and agent use by pilot users.

**OWASP adoption context:** Source code and engineering material can move through assistants, platforms and agent workflows as well as shadow tools; protection should follow the content.

**Mappings:**
- NIST CSF 2.0: PR.DS-02, DE.CM-09 — Code-exposure findings across browser, IDE, desktop, CLI and agent paths supply runtime-monitoring and in-transit protection inputs. Demonstrated detection coverage does not imply every transfer is stopped.
- NIST AI RMF: MANAGE 1.3 — Source-code detection informs planned disclosure-risk responses and responsible-use rules across AI channels. The buyer still needs to select and operate the response.
- SOC 2: C1.1, CC6.7; ISO 27001: A.8.12 — Identifying exposure of code designated confidential supplies inputs to confidentiality and leakage controls. It does not establish ownership, licensing compliance, repository access management or enforced prevention.
SOC 2: C1.1: The Confidentiality category and relevant information must be in scope.
ISO/IEC 27001: A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response.
- ISO 42001: A.9.2 — Detecting source-code exposure supplies a specific input to responsible AI-use procedures across the supported channels. This link requires documented prohibited-input rules and an operated disposition; detection alone does not select or implement the response.