Shadow AI: Employees Are Leaking Sensitive Data Through ChatGPT Without Realising It

·1 views

Employees across organisations routinely paste sensitive data — including PII, API keys, proprietary code, and confidential client documents — into public AI tools like ChatGPT to solve work problems faster, a practice known as shadow AI. Because such requests appear to network monitors as ordinary encrypted web traffic, traditional data loss prevention tools typically fail to detect or flag the leaks. A widely cited incident involved engineers pasting proprietary source code into ChatGPT, with the data becoming permanently unrecoverable and going undetected by security systems. Security experts warn that simply banning AI tool usage is ineffective, as employees tend to circumvent restrictions using personal devices or accounts, making the problem harder to monitor. The recommended approach combines an approved, organisation-controlled AI pathway, a clear and concise usage policy, and active detection mechanisms to make data governance enforceable.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Swift Classes Use Reference Types, Meaning Copies Share the Same Data

In Swift, classes are reference types, so assigning a class instance to a new variable does not create an independent copy of the data. Both variables point to the same memory location, meaning a change made through one variable is reflected in the other. This contrasts with structs, which are value types that produce fully independent copies when assigned. The reference-type behavior is intentional and useful for managing shared state across multiple parts of an app, such as a user profile displayed on several screens. Developers who need a true independent copy of a class instance must manually implement a copy method that initializes a new instance with the same values.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Popular JSON minifiers silently corrupt large integers above JavaScript's safe limit

A flaw in widely used JSON minifiers causes large integers — such as database or Snowflake IDs — to be silently altered when processed through JavaScript's JSON.parse and JSON.stringify methods. Any integer exceeding Number.MAX_SAFE_INTEGER (9007199254740991) can lose precision without triggering an error, producing output that is syntactically valid but numerically incorrect. This can cause hard-to-trace bugs when corrupted IDs are used in database lookups, API calls, or foreign key references downstream. The root cause is the parse-then-stringify round-trip approach most minifiers rely on, which converts JSON numbers into JavaScript floating-point values. The recommended fix is to minify JSON at the character level — stripping only whitespace — so number literals are preserved exactly as written in the original input.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DeepShrink lets users compress video to an exact file size with one command

DeepShrink is an open-source command-line tool written in Rust that compresses video and audio files to a user-specified size limit without uploading files to external servers. The tool works by driving ffmpeg under the hood, automatically calculating the required bitrate and running a two-pass H.264/H.265 encode to guarantee the output meets the target size. Users simply specify a file and a size limit, such as 8 MB for Discord, and DeepShrink handles all technical parameters including codec selection and audio bitrate. It also supports an optional VMAF quality floor to prevent over-compression, and the original file is never modified unless the user explicitly requests it. DeepShrink is available via Homebrew on macOS or through Rust's cargo package manager, with cross-platform ffmpeg installation required for the latter.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Launches 'hallint' to Catch Security Bugs Introduced by AI Coding Tools

A developer has released hallint, a free open-source static analysis tool designed to detect security vulnerabilities commonly introduced by AI coding assistants such as GitHub Copilot, Cursor, and ChatGPT. Unlike traditional linters built for human-written code, hallint targets recurring AI-specific failure patterns including hardcoded secrets, SQL injection via template literals, missing authentication middleware, and overly permissive CORS settings. The tool supports JavaScript, TypeScript, and Python codebases and ships with 11 targeted security rules spanning critical, high, and medium severity levels. It uses three detection layers — regex matching, AST analysis, and an optional LLM-based semantic review via providers like OpenAI, Anthropic, or a local Ollama instance. hallint is available as both a CLI tool and a TypeScript library that can be integrated into existing development workflows.

0 comments Read more at DEV Community