Nigeria AI coding assistants: API keys, BVN test data and the NDPA

It is 1 a.m. in Yaba. A developer at a payments startup is stuck on an integration bug. He pastes the config file, a slice of logs and the test dataset into his AI assistant. The answer comes back quickly. Along with the question, a production API key and about a hundred real BVNs, copied from the customer database months ago, have just gone to an outside service.

Nobody meant any harm. This is daily life for many tech teams in Lagos, where AI coding assistants are now part of the toolkit. Nigerian law, however, makes no exception for developers.

Lagos now codes with AI

From Yaba to Lekki, fintech, logistics and e-commerce startups ship fast with small teams. AI assistants built into the editor, command line tools and general chatbots help write tests, explain an error or migrate a service.

The state is pushing in the same direction. The National Artificial Intelligence Strategy 2025-2029, published in September 2025 by the Federal Ministry of Communications, Innovation and Digital Economy, bets on AI adoption, and the 3MTT programme is training thousands of young developers. More AI in the code also means more sensitive data passing through these tools.

Three leaks you find everywhere

Secrets

Payment gateway API keys, cloud access tokens, database passwords: they live in .env files, deployment scripts and error messages. A single copy and paste is enough to expose them.

Test data that is not test data

To move fast, a team copies a slice of the production database into its fixtures. The names, phone numbers, BVNs and NINs are then real. When that file goes into a prompt, customer data leaves the company.

Source code

Fraud rules, scoring models, reconciliation logic: for a fintech, code is often the most valuable intellectual property it owns. Sending it to a consumer tool with no contract and no control means losing your grip on it.

What the NDPA 2023 means for a tech team

The Nigeria Data Protection Act of 2023 applies to any processing of personal data, including a database dump sent to an AI assistant. A BVN, tied to the customer's biometric data, or a NIN issued by NIMC, does not become harmless because it sits in a test file.

• The Act requires security measures suited to the risk, and that covers the tools developers use.

• The NDPC's General Application and Implementation Directive (GAID), in force since September 2025, requires an impact assessment before any AI deployment.

• A personal data breach must be reported to the NDPC within 72 hours.

• For organisations of major importance, the fine can reach 10 million naira or 2% of annual gross revenue, whichever is higher.

We cover this framework in our article on the NDPA 2023 and generative AI in fintech.

Command line agents are a different story

A chatbot only sees what you paste into it. An AI agent running in a terminal can read the whole repository: config files, shell history, environment variables, sometimes SSH keys. It runs commands and sends their output to the model.

The risk changes scale. A developer who asks the agent to "fix the tests" may, without knowing it, let it read a production .env file. We walk through these scenarios in our analysis of how CLI AI tools leak your secrets.

Simple rules for the team

Banning assistants does not work: developers would just move to personal accounts. A few clear rules, written into the contribution guide, work better.

1. No real data in tests. Generate fake 11 digit BVNs and NINs, made up names and phone numbers.

2. Secrets out of the code. A secrets manager, separate keys per environment, immediate rotation when in doubt.

3. Limited context. Keep .env files, dumps and sensitive folders out of what AI tools can read.

4. Approved tools. A short list of allowed assistants, on business accounts.

5. Impact assessment. Document coding assistant use in the assessment the GAID requires, signed off by the DPO.

Control at the moment data leaves

Rules are not enough at 1 a.m. with a release due. Control has to happen on the device, at the moment text is sent to the AI.

In practice, the tool spots an API key, a BVN or an account number in the prompt or the attached file. It can then warn, block, or replace the value with a fake one in the same format. The model still understands the code but never sees the real data. Our guide to format preserving anonymization explains the method. Every prevented incident is logged, which feeds the annual audit and the impact assessment. These issues go beyond Nigeria, as our report on AI and data protection in West Africa shows.

Key takeaways

• AI coding assistants expose three things: secrets, real data hidden in tests, and source code.

• The NDPA 2023 and the GAID apply to tech teams too.

• Command line agents read far more than what you show them.

• Simple rules plus control on the device cut the risk without slowing developers down.

ZeusLock spots API keys, BVNs and other sensitive data before they reach ChatGPT, Copilot, Claude or Gemini, and keeps a record of prevented incidents. Book a demo to protect your engineering teams.