Plan and execute an organization-wide rollout of Manicode code security prompts.
Phase 1: Current State Assessment
Before selecting prompts, assess your organization's environment.
| Question | Notes |
|---|
| Which AI coding tools are developers using? (Copilot, Cursor, Claude Code, Devin Desktop, etc.) | |
| Which LLM APIs are integrated into products? (OpenAI, Anthropic, Google, etc.) | |
| Which AI models are approved for use? | |
| Is there a central AI/ML platform team? | |
Technology Stack Inventory
| Question | Notes |
|---|
| Primary backend languages and frameworks | |
| Primary frontend languages and frameworks | |
| Mobile platforms (iOS, Android, Flutter, React Native) | |
| Infrastructure (cloud provider, container orchestration) | |
| Database systems | |
| Authorization policy engines (OPA, OpenFGA, Cedar, etc.) | |
Phase 2: Prompt Selection
Match each team's primary framework and version to its prompt. Find prompts in the registry.
| Team / Project | Language | Framework and Version | Prompt ID |
|---|
| Example: Backend API | Python | Django 5.2 | python/django/5.2 |
| | | |
| | | |
Phase 3: Integration Architecture
Choose how prompts reach your teams: commit them to each code repo (see Team and Enterprise Deployment), or load them in API calls (see API and Programmatic Usage).
Phase 4: Phased Rollout Plan
Week 1–2: Pilot
| Activity | Details |
|---|
| Select 2–3 willing teams | Prefer teams with security-aware developers and active AI tool usage |
| Deploy code security prompts | Configure IDE files for primary repos |
| Collect baseline metrics | Record current security finding rates from SAST/code review |
Week 3–6: Expansion
| Activity | Details |
|---|
| Roll out to remaining high-risk codebases | Prioritize repos with sensitive data handling |
| Add prompts for AI frameworks and SDKs | For teams building LLM and RAG applications |
| Add infrastructure prompts | For teams managing Kubernetes manifests, Terraform, GitHub Actions |
| Create internal documentation | Onboarding guide, FAQ, support channel |
Week 7+: Standardization
| Activity | Details |
|---|
| Add prompt presence to PR checklist or CI | Verify prompts are configured before merge |
| Establish update cadence | Quarterly review and refresh of prompt selections |
| Track adoption metrics | Dashboard covering framework coverage |
| Run effectiveness reviews | Compare pre/post security metrics |
Phase 5: Success Metrics
Adoption Metrics
| Metric | How to Measure | Target |
|---|
| Repos with code security prompts configured | Scan for IDE config files across repos | 80%+ of active repos |
| Framework coverage | Prompts deployed for all primary frameworks | 100% of primary frameworks |
| Developer awareness | Internal training/communication | All AI-using developers |
Effectiveness Metrics
| Metric | How to Measure |
|---|
| Security findings per code review | Compare SAST/review findings before and after |
| Time to remediate security issues | Track from finding to fix |
| Developer satisfaction | Quarterly survey |
Related Pages