Security Standards and Compliance
Your compliance team just sent the quarterly audit checklist. Forty-seven items covering OWASP Top 10, SOC 2 controls, GDPR data handling, and PCI DSS requirements for the payment module. Last quarter, this took your team three weeks of manual review. This quarter, you have AI tools — but your security team wants to know exactly what data those tools can access and whether AI-generated code meets compliance standards.
What You’ll Walk Away With
Section titled “What You’ll Walk Away With”- Security-first AI tool configuration that satisfies enterprise security teams
- Automated compliance checking workflows using AI-assisted code review
- Data governance frameworks for AI tool usage in regulated environments
- Prompt patterns for security-focused code generation and vulnerability scanning
- Audit trail implementation that proves AI-generated code meets standards
Configuring AI Tools for Security
Section titled “Configuring AI Tools for Security”Data Handling Policies
Section titled “Data Handling Policies”Before writing a single prompt, establish what data can and cannot be sent to AI providers.
Cursor Business offers Privacy Mode, which ensures no code is stored or used for training:
SECURITY REQUIREMENTS:- Privacy Mode MUST be enabled (Settings → Privacy → Privacy Mode ON)- Never paste production credentials, API keys, or secrets into prompts- Never paste customer PII (names, emails, SSNs) into prompts- When discussing database schemas with PII columns, use anonymized names- Reference .env.example for environment variable names, never .envCursor Business provides SOC 2 Type II compliance and zero data retention guarantees.
Claude Code respects .claudeignore files to prevent sensitive files from being read:
.env.env.***/secrets/**/credentials/**/*.pem**/*.key**/config/production.jsonAdditionally, configure hooks to block sensitive data from leaving the environment:
{ "hooks": { "PreToolUse": [{ "matcher": ".*", "command": "python scripts/check-sensitive-data.py \"$PROMPT\"" }] }}Claude Max and API plans provide zero data retention by default for business usage.
Codex cloud tasks run in sandboxed environments with network restrictions:
SECURITY POLICY:- Never read or output contents of .env files- Never include actual API keys, tokens, or passwords in code or comments- Use environment variable references for all sensitive configuration- Flag any hardcoded credentials found during code reviewCodex enterprise plans provide data isolation guarantees and can be configured with custom network policies.
Automated Security Scanning
Section titled “Automated Security Scanning”OWASP Top 10 Review
Section titled “OWASP Top 10 Review”Continuous Security Review in CI
Section titled “Continuous Security Review in CI”Use Cursor’s Background Agent to run security reviews on every PR:
Review the changes in this PR for security issues:1. Check for any new SQL queries - are they parameterized?2. Check for any new API endpoints - do they have authentication middleware?3. Check for any new file uploads - are they validated for type and size?4. Check for any new user inputs - are they sanitized before rendering?5. Check for any new dependencies - do they have known vulnerabilities?
Output a security review checklist with pass/fail for each item.Integrate security review into your CI pipeline using headless mode:
security-review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: AI Security Review run: | claude -p "Review the git diff for security issues: $(git diff origin/main...HEAD)
Check for: 1. SQL injection vulnerabilities 2. Missing authentication/authorization 3. Hardcoded secrets or credentials 4. Unvalidated user input 5. Insecure cryptographic operations 6. Missing rate limiting on new endpoints
Output as JSON: {issues: [{severity, file, line, description, fix}]} Exit code 1 if any Critical or High severity issues found."Codex can be triggered by GitHub PR events for automatic security review:
When a PR is opened, perform a security review:1. Analyze all changed files for OWASP Top 10 vulnerabilities2. Check new dependencies against known vulnerability databases3. Verify authentication is required on all new endpoints4. Confirm input validation exists for all new user-facing parameters5. Post findings as a PR review comment with inline annotationsCompliance Framework Implementation
Section titled “Compliance Framework Implementation”SOC 2 Controls with AI Assistance
Section titled “SOC 2 Controls with AI Assistance”GDPR Data Handling
Section titled “GDPR Data Handling”Secure Code Generation Patterns
Section titled “Secure Code Generation Patterns”Teaching AI Your Security Standards
Section titled “Teaching AI Your Security Standards”Encode your security requirements so AI-generated code is secure by default.
// .cursor/rules or CLAUDE.md - Security sectionSECURITY CODING STANDARDS:
Authentication:- All API endpoints must use the authMiddleware from /src/middleware/auth.ts- JWT tokens expire after 15 minutes, refresh tokens after 7 days- Password hashing uses bcrypt with cost factor 12
Input Validation:- All request bodies validated with Zod schemas before processing- File uploads limited to 10MB, allowed types: jpg, png, pdf- URL parameters must be validated as UUIDs where applicable
Database:- ALL queries must use parameterized statements (Drizzle ORM or prepared statements)- Never construct SQL strings with string concatenation- Database connections use least-privilege service accounts
Output:- All HTML output must be escaped (handled by React/template engine)- API responses must not include internal error details in production- Set Content-Security-Policy, X-Frame-Options, X-Content-Type-Options headersWhen This Breaks
Section titled “When This Breaks”“Our security team will not approve AI tools because they send code to external servers.” Bring the vendor’s SOC 2 report, data processing agreement, and zero retention policy to the meeting. Most enterprise AI tool plans provide contractual guarantees. Claude Code can also run with local models if absolute data isolation is required.
“AI-generated code passed review but had a vulnerability.” AI tools reduce but do not eliminate security risks. Maintain automated scanning (SAST, DAST, dependency auditing) in CI regardless of whether code is AI-generated or human-written. Security review is a defense-in-depth strategy.
“Compliance audits take the same amount of time even with AI.” You are probably running audits reactively. Set up continuous compliance monitoring with AI-powered CI checks. The quarterly audit becomes a formality when every PR is already reviewed against compliance controls.
“Different teams encode security requirements differently.” Centralize your security standards in a shared rules file and distribute it to all repositories. Use a monorepo or Git submodule for shared configuration.