Question 1

Does our source code leave our network?

Accepted Answer

Managed Pilot — code is fetched for the scan and removed when it completes. Single-Tenant Cloud, planned for H1 2027 — the same process runs inside your dedicated VPC. Air-Gapped On-Prem — the code never leaves your network.

Question 2

Is our code used to train your models?

Accepted Answer

No. Absolutely not. MOAI Labs strictly prohibits the use of customer code, telemetry, or finding data for training our underlying models. Our detection classifiers are trained exclusively on open-source datasets, synthetic vulnerability corpora, and public bug bounties.

Question 3

How do you handle false positives?

Accepted Answer

We combat false positives through a hybrid approach: strict deterministic rules combined with context-aware LLM validation. When a false positive does occur, developers can mark it as "ignore" directly within their IDE or via a PR comment. This suppresses the alert locally and feeds back into your organization's custom policy engine to prevent recurrence.

Question 4

What is the performance overhead in CI/CD pipelines?

Accepted Answer

For the checks that run on every pull request — static analysis, secrets, and dependencies on the diff only — a typical scan finishes in seconds. Heavier analysis such as fuzzing and automated pentest runs on a schedule or on demand, not on the critical path of a merge.

Question 5

How does the exception process work?

Accepted Answer

Security should not halt critical hotfixes. In soft-block mode, developers bypass a blocked commit by adding a justification tag to the commit message; the exact format is configurable. The action alerts AppSec and is recorded in the audit trail for review.

Question 6

How are offline updates managed for air-gapped deployments?

Accepted Answer

We provide securely signed update bundles (containing new threat intelligence signatures, policy rules, and model weights) via a secure artifact repository. Customers can pull these artifacts down, scan them with internal tools, and push them to their air-gapped environment via their standard secure transfer protocols.

Question 7

What happens if we decide to stop using AI.CleanCode?

Accepted Answer

To remove AI.CleanCode, uninstall the extension and remove its pipeline step and any configured Git hooks or script calls. No application source-code changes are required; the rest of your build configuration stays as it is. Historical findings and audit logs already exported to your own SIEM or ticketing system remain there under your retention policy. Export any records you need before decommissioning the deployment.

Question 8

Which model do you use, and where does it run?

Accepted Answer

The model is optional. When enabled, AI.CleanCode uses a security-tuned open-weights model served by vLLM on your own GPU inside the customer environment. No code, prompt, or finding is sent to a third-party model provider. In Air-Gapped On-Prem deployments, there is no outbound connection at all.

Question 9

What happens if the GPU or the model is unavailable?

Accepted Answer

Deterministic scanners continue to run and their findings remain available. Model-based validation and suggested fixes are marked unavailable rather than silently skipped; policy can decide whether a CI quality gate degrades to scanner-only results or fails closed.

Question 10

How are licences counted for contractors and CI runs?

Accepted Answer

Interactive use is licensed per named developer, including contractors who use the extension. Automated CI runs do not consume a developer seat. Server licensing is available for teams of ten or more; exact contractor and concurrency terms are confirmed in your order form.

Frequently Asked Questions