How to secure code written by Copilot, Cursor and Claude Code

STEP 01

Step 1. Which assistants, models and MCP servers are in use?

You cannot set policy for agents you do not know about. Build an inventory of coding assistants, the models they call, the MCP servers they connect to and the rule files in each repository. Several tools do this: Legit VibeGuard discovers assistants, models and MCP servers across the engineering org; Cycode's AI-BOM records rule files, MCP servers and AI API keys with commit provenance; Endor Labs AURI inventories agents, models, MCP servers and skills; OX VibeSec keeps an AI inventory.

STEP 02

Step 2. Where should security instructions go for each assistant?

Each assistant reads instructions from its own files. Put your secure coding rules there, and review changes to these files like code.

• GitHub Copilot: repository-wide instructions in .github/copilot-instructions.md, and path-specific instructions in .github/instructions/NAME.instructions.md. When both match, Copilot uses both.

  Source: GitHub Docs: repository custom instructions · Reviewed Sep 2026

• Cursor: project rules in the .cursor/rules directory, in MDC format. The older .cursorrules file still works but is deprecated.

  Source: Cursor Docs: rules · Reviewed Sep 2026

## Security rules for this repository
- Use parameterized queries. Never build SQL from string concatenation.
- Never hardcode credentials. Read secrets from the environment.
- Add new dependencies only from the approved registry, pinned to a version.
- Validate and encode all user input before rendering it.

Instructions are guidance, not enforcement. Legit VibeGuard can attach security instruction files to assistants centrally, and OX VibeSec generates guidance from each prompt; both reduce the chance that a rule file is missing or stale.

STEP 03

Step 3. How do you enforce policy on what an agent runs?

Instructions can be ignored. Enforcement acts before a command or tool call runs. In Claude Code, a PreToolUse hook runs before each tool call and can block it by exiting with code 2 or returning a permission decision of deny. Organizations can set hooks in managed policy settings, and the allowManagedHooksOnly setting blocks user, project and local hooks while keeping managed ones.

Source: Claude Code Docs: hooks · Reviewed Sep 2026

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          { "type": "command", "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-rm.sh" }
        ]
      }
    ]
  }
}

Illustrative. Check the Claude Code hooks documentation for the current schema before use.

Across many agents, product-level enforcement saves writing hooks per tool: Legit VibeGuard 2.0 monitors and enforces commands against built-in or custom policy and blocks dangerous operations; Snyk Evo can evaluate, steer or block risky agent activity; Endor Labs AURI applies policy at the moment of action; Semgrep Guardian uses hooks that fire on every file write.

STEP 04

Step 4. How do you keep secrets out of prompts?

Agents read files to build context, and those files can hold keys. Block environment files and credential stores from agent context, and scan prompts and tool calls for secrets. Legit VibeGuard blocks API keys, tokens and passwords from being shared with AI systems during generation; Cycode's IDE guardrails intercept secrets, prompts and tool calls before they reach external AI services; OX VibeSec includes secret protection. On the repository side, GitHub push protection blocks commits that contain secrets.

STEP 05

Step 5. How do you stop agents installing malicious packages?

Agents add dependencies quickly and sometimes pick the wrong name. Check packages at install time, not only at pull request. Options include Aikido Safe Chain, which blocks malware at package install; Endor Labs' package firewall and malicious package detection; Semgrep Guardian, which blocks malicious dependencies before installation; and OX VibeSec's malicious dependency blocking.

STEP 06

Step 6. What should run on every pull request?

Treat agent-written pull requests like any other: SAST, SCA and secrets scanning on every change, with required checks before merge. GitHub's Copilot coding agent runs CodeQL, GitHub Advisory Database and secret scanning checks on its own changes, without a GHAS license, but code from other assistants still needs your pipeline's checks.

Source: GitHub changelog, 28 October 2025 · Reviewed Sep 2026

STEP 07

Step 7. How do you decide which findings to fix first?

Agent-written code raises the volume of findings. Rank by what is reachable and exposed: Endor Labs reports vulnerabilities on reachable code paths; Apiiro's Risk Graph ties changes to runtime context; Cycode's AI Exploitability Agent confirms reachability; Legit scores risk by business criticality, GenAI use and internet exposure.

STEP 08

Step 8. How do you audit what agents did?

Keep a record of agent actions so incidents can be traced. OX VibeSec has an agent activity log, Endor Labs AURI keeps audit trails, and Legit VibeGuard 2.0 monitors agent commands. Review the log when a rule file changes or a new MCP server appears.