Is Cody: AI Code Assistant safe?

Findings

Communication With Expired Domain

Flags items that communicated with a domain that has expired, which can be exploited by threat actors to hijack the domain and deliver malicious payloads, steal data, or impersonate trusted infrastructure.

medium

Uses Third Party AI Model

Flags items that process data using third-party AI models. AI models can be used to process data in a way that may not be transparent to the user. This can lead to organization policy violation, data leakage, privacy concerns and potential misuse of data.

low

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

CODE INSIGHTS ARE AVAILABLE FOR ENTERPRISE USERS

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

API CALLS ARE AVAILABLE FOR ENTERPRISE USERS

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

URI

/extension/dist/extension.node.js

Unverified

URI

/extension/dist/extension.node.js.map

Unverified

All secrets are available for Enterprise users

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS

External communication

Any identifiers we detected that may indicate external communication from the item's code

https://winkjs.org/wink-nlp-utils/tokens.html

extension/src/wink-nlp-utils.d.ts

https://winkjs.org/wink-nlp-utils/string.html

extension/src/wink-nlp-utils.d.ts

https://peps.python.org/pep-0257/

extension/src/tree-sitter/query-sdk.ts

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

@anthropic-ai/sdk

Version:

Unknown

@lexical/code

Version:

Unknown

os-browserify

Version:

Unknown

All dependencies are available for Enterprise users

Licenses & Compliance

Compliance

Compliance status and certifications for the extension and its publisher

Sourcegraph

Sourcegraph explicitly states that it is in compliance with the California Consumer Privacy Act (CCPA) of 2018, indicating that the company is CCPA compliant. However, there was no parent company mentioned, therefore, compliance status for a parent company is not applicable.

Compliant

Licenses

No license text available...