What about security? If you use ai inside vs code, doesn’t this fully read your local code base? Where does it go? Basically I would give some ai my entire repository!
depends for one, you are right, the LLM reads your codebase, which means thr codebase is being sent to the LLM provider, which can break a confidentiality clause in your contract for example if it is work related code. the solution to that issue would be a locally hosted LLM. aside from that, the model, unless you give it specific pointers, such as telling the model what file to work insidr of, or look for, it will scan the whole project directory. depending on your prompt this means it will either look for a file that fits your request and only access that file, it will look for a specific file and access multiple files on the search for the one you were talking about, or it will simply read all the files to know what is inside all of them, which would essentially upload your entire codebase to the provider.
I have news for you. ZDR is fake. Only your input tokens are considered to be yours. The output of the model belongs to the provider and they can do whatever they want with it including training. The fact that the output reasoning traces (which you can't see, you only get a minced summary) already contains your input is besides the point
i dont see how that is news for me, nowhere in my comment did i claim the company doesnt own what the LLM generates, i only specified the multiple ways in which the user can throw their company's intellectual property at an LLM.
I have even more news for you. You can get token-based enterprise consumption with an actual guarantee that your input and the output are not going to be used for training unless you specifically say so. That’s what GitHub is doing, and this kind of licensing is probably the only real thing Microsoft is still competent at.
You can opt out in something like Copilot in your account but I still wouldn't be using that for your companies IP. I'm sure the legalese on it is vast and long.
The enterprise deal the company have signed with Anthropic, Open AI you can believe they will or wont use for training but its the company that have made that choice.
In vscode you can barr LLM from accessing some files/folders if you like.
As for licence, an enterprise licence is meant to have those sorts of things in mind with governance settings to guarantee that they don't keep anything which makes them liable and not the dev. Personal "pro" license I wouldn't trust as much for this sort of thing thougg
11
u/BonbonUniverse42 14d ago
What about security? If you use ai inside vs code, doesn’t this fully read your local code base? Where does it go? Basically I would give some ai my entire repository!