The Unwritten Rule Everyone Skims

There is a section in your employee handbook. It is somewhere between the vacation policy and the acceptable use of company equipment clause. People skim past it during onboarding. It rarely comes up at your first sprint planning meeting.

It says something like: "Employees may transmit proprietary, confidential, or trade secret information to third-party systems only with explicit authorization from the information security team."

Your company's code is proprietary. The LLM API running on Anthropic's or OpenAI's servers is a third-party system.

Every time you paste a function from your authentication service into ChatGPT to ask why it is throwing a 403, you are technically in violation of this clause. Every Copilot completion that completes from your production codebase context is sending that context somewhere.

This is a practical note, far from a legal brief. Knowing what the actual rule says helps you make an informed decision about how to handle it.

What Your Legal Team Would Say If They Knew

Let's do a quick exercise. Imagine the following scenarios play out, and your legal or security team finds out.

Scenario 1: You paste your customer data schema into ChatGPT.

Your database schema for the users table includes field names that reflect your business model. subscription_tier, churn_risk_score, payment_method_last4. You are asking GPT-4 to help optimize a query. The schema goes to OpenAI's servers. Your legal team's concern: the schema reveals your business logic and your customers' financial data structure.

Scenario 2: You use Copilot on authentication code.

GitHub Copilot receives your entire open file as context when generating completions. If you are working in src/auth/session-manager.ts, Copilot sees your session validation logic, your JWT structure, your permission model, and whatever comments you have written about how it works. Your security team's concern: your authentication implementation is now on Microsoft's servers.

Scenario 3: The API key in a comment gets included in context.

You have a comment from six months ago: // TODO: rotate this before deploy. The key is in a file that is part of the context your IDE sends with the next Copilot request. Your security team's reaction to scenario 3 goes beyond hypothetical concern. It is an incident report.

The Pragmatic Developer's Position

Here is the honest counterpoint: AI tools make you 30 to 40 percent faster on most coding tasks. That figure comes from measurement, far from marketing copy: productivity studies from GitHub, Stripe, and McKinsey have measured it. Writing tests, understanding unfamiliar codebases, refactoring, and debugging all go faster with AI assistance.

Banning these tools hurts the company more than using them carefully.

Teams that ban AI tools have three failure modes. First, engineers use them anyway on personal devices or accounts, creating shadow AI behavior that is completely untracked and unauditable. Second, engineers at companies with the ban compete against engineers at companies that allow the tools, and the productivity gap compounds over 12 to 18 months. Third, the best engineers leave for environments where they can use the tools they want to use.

The pragmatic position is: use the tools. Use them carefully. Put one layer of protection in place so you can honestly say you took reasonable precautions.

Three Rules That Protect You AND Let You Use AI

You can apply these three rules on your own, with zero team rollout and zero waiting on approvals. You can implement all three today.

Rule 1: Route your AI tool through a local proxy.

A local proxy sits between your IDE and the LLM API. It intercepts outbound calls, swaps proprietary identifiers and secrets for stand-in tokens, and logs what was transmitted. You keep using the same tool. You just add one environment variable.

Pretense is the tool built specifically for this. Install it globally, start the proxy, set ANTHROPIC_BASE_URL=http://localhost:9339 or OPENAI_BASE_URL=http://localhost:9339, and your tool continues working exactly as before. Every API call is now protected and logged.

The proxy approach also gives you an audit trail. If your security team ever asks what was sent to external AI APIs during a given project, you have a structured log with timestamps, mutations applied, and secrets swapped.

Rule 2: Keep secrets out of copy-paste.

This sounds obvious. It is also the source of a large proportion of credential leaks. The pattern is: you are debugging an issue that requires a real API key to reproduce. You temporarily paste the key into a file, or into a comment, or into a test fixture. Then you forget about it. Three weeks later, that file is in AI context. The fix: use environment variable references exclusively in code.

Rule 3: Use enterprise tiers of tools when your company pays for them.

If your company has a GitHub Copilot Business or Enterprise subscription, use that account over your personal Copilot Individual account. The data handling terms are materially different. Enterprise tiers typically include explicit opt-out from training, shorter log retention, and contractual data processing agreements.

The 2-Minute Setup That Covers You

If you do one thing after reading this, do this:

curl -fsSL https://pretense.ai/install.sh | sh
cd your-project
pretense init
pretense start
export ANTHROPIC_BASE_URL=http://localhost:9339

That is it. Your AI tool now routes through a local proxy that swaps proprietary identifiers and secrets for stand-ins before the prompt leaves your machine, and logs every session. Your workflow stays the same. You added two minutes of setup.

When your security team or your manager asks whether you are handling AI tool usage responsibly, the answer is: yes, you are routing through a local proxy with an audit trail. That answer covers you.

How I run Pretense on my own code

I build Pretense with Claude Code, and my sessions run through it. Here is the setup I give a new engineer, in order.

1. -Run the agent through the proxy. Type pretense run claude where you would type claude. It starts a local proxy on port 9339, points Claude Code at it and stops the proxy when the session ends. Detected secrets and PII leave the laptop as stand-in tokens.
2. -Put hooks on every repo. pretense install adds a pre-commit and a pre-push hook. A key that never lands in git is a key an agent never reads.
3. -Scan before an agent reads the repo. pretense scan path . lists what it finds. In CI, pretense scan ci exits 0 when clean, 2 on findings and 3 when it examined nothing. Treat 3 as a failure.
4. -Preview the swap. pretense review . shows what would be mutated. pretense mutate <file> --preview prints one file mutated and leaves the file on disk as it was.
5. -Round-trip a file you need to share. pretense mutate <file> --map <map> swaps the secrets in place. pretense reverse <file> --map <map> turns it back into the original, byte for byte, from the encrypted map on your machine. We run that round trip on real files before every CLI release and compare sha256 hashes.

One thing I learned the hard way: inside a session the agent sees stand-ins, so a file the agent writes can hold a stand-in where you expected a real value. Grep what the agent wrote before you ship it.

What Pretense will not do is put a secret back into the model's answer. Code identifiers come back byte-exact. Secrets and PII stay as stand-ins in the response. That is deliberate: a prompt-injected model can echo a token into a link, and reversing it there would hand over the real key.

What this means if you lead an engineering team

The outcome: your team keeps asking AI assistants about real systems, configs and connection strings, and detected secrets leave each laptop as stand-ins.

• -No new workflow. Engineers type pretense run claude in place of claude. Other AI CLIs run the same way, for example pretense run gemini.
• -Guard the repo as well as the prompt. pretense install adds pre-commit and pre-push hooks. pretense scan ci in the pipeline fails on findings (exit 2) and on an empty scan (exit 3).
• -Answers stay usable. Identifiers inside fenced code blocks go out as stand-ins and come back byte-exact, so the code the model writes still uses your names.
• -Measure before you mandate. Run it on your own repo for a week. pretense audit shows what it swapped and when.

Try it on your own repo: create a free account, then run npm i -g @pretense/cli and pretense run claude. If you need a security review first, talk to me.