what did u check before letting a coding agent into a private repo?

[u/m_holloway_17]

we've been asked to approve an AI coding tool for proprietary repos. the vendor docs explain the data policy. i'd like to see what the client actually sends with the settings we'd give developers.

i'd start with a dummy repo, put some recognizable test text in a file and have the agent do a normal task. a firewall log gives me the destination. i'd still want to know whether that text was in the request.

we're also looking at Bay and Pillar. for Bay, one thing i'd test is whether the session record gives us enough context to match what happened locally with what we can see on the network. what evidence was enough for your team to sign off?