Developer Tooling Governance

Developer tooling governance covers the policies and controls that decide which AI coding assistants, code-generation plugins, and related software tools engineers may install and use, and what data those tools can reach. It matters because these tools often run with access to source code, credentials, and internal systems, so a single poorly vetted extension can leak proprietary code or open a path into company infrastructure. Compliance and risk teams use this area to set approval processes, usage rules, and audit requirements before tools spread across engineering teams.

1 item

ResearchGlobal2026-11-02

Miasma Campaign Exposes AI Coding Config Files as an Unreviewed Attack Surface

In June 2026, attackers planted malicious instructions inside a Microsoft repository's AI coding assistant configuration file to harvest developer credentials without modifying any application source code. A subsequent October 2026 analysis by StepSecurity found the malicious commit used a flag to bypass automated pipeline checks and a backdated timestamp to evade detection. Most enterprises have not extended their code review and change-approval requirements to cover these configuration files.

AI coding assistants supply chain security developer tooling governance software pipeline controls Claude Code insider threat credential theft