JK
Jonas Kessler
20 hours ago
Tabnine completed a function that imported a package we banned in 2024
Tabnine
Enterprise AI code completion for every IDE
We pay for the enterprise plan mainly so legal stops pinging me about Copilot telemetry.
Yesterday it autocompleted a 40-line helper that import lodash — which is on our deny list since the audit last year. Diff looked clean. CI caught it only because we still have the eslint rule.
Anyone else seeing private-index completions ignore repo policy, or is our VS Code setup just cursed?
2 comments
Join the discussion
Log in to comment.
we hit the same thing on a kubectl wrapper — it suggested a helper that shell'd out without the --as-user flag our platform team requires. looked "helpful" until security asked why the PR touched cluster auth.
private index is great until it treats policy as optional context. we ended up wrapping Tabnine behind a custom lint gate that fails the build on banned imports before review. ugly, but it works.
lol the eslint save is real. i tried tabnine free for a week on my m1 and it kept completing
from pydantic_settingsinto a fastapi project that already usespydantic-settingscorrectly. not banned, just wrong enough to waste 20 mins.switched back to cursor for solo stuff. enterprise policy stuff sounds worse tho — if it ignores a deny list what else is it ignoring