Step-by-Step Instructions

1. Identify Your Tool’s Configuration Docs
   
   

   • Example: If you’re using GitHub Copilot, check GitHub Docs: Copilot Settings.

   • For Tabnine, read the Tabnine Privacy and Config Docs.

   • For Amazon CodeWhisperer, consult the AWS Official Docs.

2. Open Your IDE’s Extension/Plugin Settings
   
   

   • VS Code: Click the Extensions icon → select the code assistant → click the gear icon for Extension Settings.

   • IntelliJ/JetBrains: Go to Settings/Preferences → Plugins → find your assistant’s plugin → check Settings or Configuration.

   • Other Tools: Follow official instructions or a plugin’s readme to locate advanced preferences.

3. Check for Data Sharing / Telemetry Toggles
   
   

   • Look for options like:

     • “Send code snippets to the cloud”

     • “Enhance suggestions by sharing usage data”

     • “Telemetry” or “Analytics”

   • If you see these, decide whether to disable them based on your organization’s policy or your preference for privacy.

4. Opt Out of Unwanted Data Collection
   
   

   • If your policy requires no external data usage:

     • Turn off any “Send my code” or “Telemetry” features.

     • Confirm that changes are saved; some tools require a restart of the IDE to apply settings.

   • If you’re comfortable with partial data sharing (for better suggestions), review your compliance guidelines to ensure it’s allowed.

5. Verify the Configuration
   
   

   • Reload your IDE or plugin.

   • Try coding a snippet.

   • Ensure you still get suggestions, though they may be less tailored (some AI tools rely on usage data to improve suggestions).

   • If you’re on an enterprise plan, check admin or org-level settings to confirm changes for all users.

6. Document Your Changes
   
   

Create or update a file, e.g., SECURITY.md or ASSISTANT_CONFIG_NOTES.md:
markdown
CopiarEditar
# AI Assistant Configuration

- Disabled “Telemetry” and “Send code to Cloud” features in Copilot.

- Verified local environment variables remain private.

- AI suggestions remain functional, though potentially less personalized.

• 
  

• This ensures teammates or compliance officers know how the tool is configured.

7. Consider Additional Security Measures
   
   

   • If your code is highly sensitive:

     • Evaluate running an on-premise or self-hosted model (if available).

     • Implement scripts or gatekeepers to prevent accidental sharing of credentials or tokens with the AI.

   • If cost is a concern, set usage limits or alerts for token-based assistants.

8. Wrap Up
   
   

   • You’ve now reviewed your AI assistant’s config and ensured minimal risk of exposing private files or data.

   • You’ve also learned how to disable telemetry, aligning with security, cost, or ethical constraints.

Step-by-Step Instructions

1. Choose a New Feature & External Library
   
   

   • Select a library relevant to your project:

     1. Example #1: A logging library (like winston for Node.js).

     2. Example #2: An HTTP client (like axios or requests for Python).

     3. Example #3: A specialized library for image processing, PDF generation, etc.

   • Decide on a feature that naturally uses this library:

     1. e.g., “Add a user activity log function,” or “Fetch data from a public API.”

2. Install or Import the Library Properly
   
   

For Node.js + axios, for example:
bash
CopiarEditar
npm install axios

For Python + requests:
bash
CopiarEditar
pip install requests

• 
  

• Ensure you add it to your requirements (package.json or requirements.txt) so you can see if the AI tries to import or “copy” code.

3. Implement the Feature Using Your Code Assistant
   
   

   • In your IDE, start a file or function, e.g. logActivity.js or fetchData.py.

Type a brief comment:
javascript
CopiarEditar
// I'd like to use the 'winston' library to log user actions in a standard format

 or
python
CopiarEditar
# Let's use 'requests' to fetch data from a public API and parse the JSON result

• 
  

• Observe how the AI suggests code:

  1. Does it do a proper import axios from 'axios' or const axios = require('axios')?

  2. Or does it try to copy the library’s internal logic verbatim?

4. Check for License Compliance & Restricted Code
   
   

   • If the AI assistant suggests code that looks suspiciously large or taken from the library’s source, compare it to the library’s GitHub repo or docs:

     1. Ensure you’re not inadvertently pulling in proprietary code.

     2. Confirm the library is under MIT, Apache, or another license that allows usage.

   • If you see a block of code that the library typically encapsulates behind a simple import, you might have to reject that snippet to avoid licensing issues.

5. Avoid Exposing Credentials or Keys
   
   

   • If the library requires an API key or token, confirm your AI assistant doesn’t hardcode it in the code:

     1. e.g., “const API_KEY = 'your-very-secret-key'” in the code snippet.

Store credentials in environment variables or a secure vault:
bash
CopiarEditar
export API_KEY=your-secret-token

 Then read them in code:
javascript
CopiarEditar
const apiKey = process.env.API_KEY;

• 
  

• If the AI tries to embed a key, override it or remove that line to comply with best security practices.

6. Document Findings in SECURITY.md or ETHICS.md
   
   

Create or update a file like SECURITY.md or ETHICS.md:
markdown
CopiarEditar
# Ethical & Security Considerations

## Library Usage & Licensing

- Library Chosen: `axios` (MIT License)

- Confirmed that the AI assistant used a simple `require('axios')` statement, not replicating source code.

- Double-checked MIT license terms: usage is permissible for commercial and private projects.

## Handling Credentials

- Verified that no tokens or passwords are stored in code. 

- Using environment variables to keep keys secure.

## Potential Costs

- AI assistant charges by tokens beyond free tier if usage spikes.

- Observed ~3000 tokens used in a day. That might cost ~$X if usage remains high.

• 
  

• Summarize any problems encountered (e.g., “AI tried to add a chunk of code from inside the library—dismissed those suggestions”).

7. Test the Feature & Confirm Legal + Security Aspects
   
   

   • Run the code to ensure your new feature (logging, fetching data, etc.) works:

     1. e.g., node logActivity.js or python fetchData.py.

   • Confirm that no license or library code is copied wholesale.

If everything is good, commit to your repo:
bash
CopiarEditar
git add .

git commit -m "Add new feature with external library, documented in SECURITY.md"

git push

8. Wrap Up
   
   

   • You’ve now added a feature with an external library using your AI assistant, ensuring:

     1. Properly licensed usage (no restricted code copying).

     2. Security steps to avoid leaking keys.

     3. Documentation of potential costs if your AI assistant charges per usage.