If you are researching Amazon CodeWhisperer security in 2026, the most useful fact is one that no amount of feature comparison will tell you: you cannot sign up for it. AWS folded CodeWhisperer into Amazon Q Developer on April 30, 2024, and then announced end of support for Q Developer itself two years later. New signups stopped on May 15, 2026.
That changes the question. "Is CodeWhisperer safe" is no longer a purchasing decision. It is a question about code you already wrote, a plugin that may still be sitting in your IDE, and a subscription with an expiry date on it.
TL;DR
CodeWhisperer no longer exists as a product. It became Amazon Q Developer on April 30, 2024, and AWS announced on April 30, 2026 that Q Developer IDE plugins and paid subscriptions reach end of support on April 30, 2027, with new signups blocked from May 15, 2026. The privacy story was always tier-dependent, and the tier names in most guides (Individual and Professional) are retired. If you used the free tier and never found the opt-out, treat anything in those files as having left your machine.
The timeline, with dates
Amazon CodeWhisperer becomes part of Amazon Q Developer. AWS's own rename summary puts it plainly: "On April 30, 2024, Amazon CodeWhisperer became a part of Amazon Q Developer." The CodeWhisperer Professional admin setup is explicitly described as different from Q Developer Pro, so this was not a pure relabel.
AWS publishes the Q Developer end-of-support announcement on the DevOps blog.
New signups stop. New Q Developer Free Tier account creation via Builder ID in the IDE plugins is blocked. Existing subscriptions can still add users.
Amazon Q Developer IDE plugins and paid subscriptions reach end of support. AWS directs users to Kiro and publishes a migration guide.
Two years of writing about CodeWhisperer as a live competitor to Copilot, then a rename, then a wind-down. Most of the comparison content on the web, including an earlier version of this page, is describing a product that stopped existing under that name before the article was written.
Which situation are you actually in?
You never used it. Then the security question is moot, and the interesting part is the migration target. AWS recommends Kiro for the IDE capabilities.
You have a Q Developer Pro subscription. You keep plugin access until April 30, 2027. Nothing breaks tomorrow. Start planning the move, because the date is fixed and the Opus 4.6 model was already pulled from Q Developer Pro on May 29, 2026.
You used CodeWhisperer years ago and moved on. This is the group with an actual security exposure, and it is the one nobody writes for. Read the next section.
What your code was exposed to
The old CodeWhisperer tiering split privacy by plan, and this is where the stale guides do real damage. Under the original split, the free Individual tier could use your code for service improvement unless you went into settings and opted out. Professional never did.
The opt-out was not obvious and it was not retroactive. If you installed the free plugin, accepted suggestions for a few months in 2023 or 2024, and never opened the data-sharing setting, code context from those files was sent to AWS. Nothing you do in 2026 pulls it back.
The practical follow-up is not "was AWS trustworthy with it." AWS is a reasonable custodian. The practical follow-up is: what was in those files?
If any of them contained a hardcoded API key, a database URL with a password in it, or an AWS access key, that secret has been transmitted off your machine, is probably still in your git history, and may well still be live. The plugin is the least of your problems in that scenario. Rotate the credential and check whether it was ever committed.
We see this constantly in scans: an AWS access key with the AKIA prefix sitting in a frontend JavaScript bundle, shipped to every visitor. The AI assistant did not put it there. A developer did, then an assistant read the file as context, then the whole thing got deployed. The assistant's own scanner does not look at your production bundle.
What the security scanning actually does
The scanning feature survived the rename. In Amazon Q Developer it is called code reviews, and AWS describes it as powered by both generative AI and rule-based automatic reasoning, with the rule-based half driven by the Amazon Q detector library.
It covers more than the old marketing suggested:
- SAST scanning for things like SQL injection and cross-site scripting
- Secrets detection for hardcoded passwords, connection strings, and usernames
- Infrastructure-as-code misconfiguration
- Software composition analysis on third-party dependencies
- Code quality and deployment-risk findings
Two details matter more than the feature list.
It reviews your diff, not your project. AWS's documentation is specific: by default, asking Q to review your code reviews only the changes in the active file, determined by git diff. If there is no diff, it falls back to the whole file. So the vulnerability a contractor committed in 2024, before you installed anything, was never examined. Assistant-based review is a forward-looking control.
The quotas are about size, not count. A lot of guides still quote "50 scans per month" for the free tier and "500 per month" for paid. Current AWS documentation gives size limits instead: auto reviews cap at 200 KB of input artifact and source, while file or project reviews allow 500 MB of input artifact and 50 MB of source. If you are choosing a tier based on a monthly scan count, you are reading a document written before the rename.
Reference tracking, and the switch your admin can flip
CodeWhisperer's reference tracker was a genuine differentiator, and it survives. Amazon Q flags suggestions similar to publicly available code, logs them with the associated license and the referenced source, and is on by default in most IDEs.
The part worth knowing is the enterprise override. An administrator can deselect "Include suggestions with code references" for the whole organization, and AWS notes that when they do, individual developers cannot opt back in through the IDE. The checkbox is still there in their settings. It just has no effect.
So "reference tracking is on by default" can be true of the product and false of your laptop at the same time. If license provenance matters to you, check the reference log for actual entries rather than trusting the setting.
Two IDEs never supported it at all: Amazon Q in Lambda does not support code references and omits any suggestion carrying one.
Four claims about CodeWhisperer that are no longer true
Comparison content ages badly, and this page is not exempt. An earlier version of it made three of these four errors.
- "CodeWhisperer is a current product with Individual and Professional tiers." Retired in the 2024 rename. Current tiers are Free and Pro at $19 per user per month.
- "Copilot has no security scanning." This was the headline argument for CodeWhisperer. GitHub's documentation now says Copilot code review provides feedback on "bugs, security vulnerabilities, and style inconsistencies," with a Balanced mode for security-sensitive code. The gap closed.
- "Air-gapped or fully private deployment is available." No version of CodeWhisperer or Q Developer ran without reaching AWS for completions. Suggestions are generated in the cloud.
- "Free tier includes 50 security scans per month." Replaced by size-based quotas, as above.
If a 2026 article recommends adopting CodeWhisperer, it was not checked against AWS's own documentation. That is a reasonable filter for the rest of its claims too.
What to do this week
The pattern behind all of this is worth stating directly. An in-IDE reviewer sees the code you write while it is installed and configured. It does not see what you shipped. Those are different surfaces, and the second one is where the incidents happen.
Is Amazon CodeWhisperer still available in 2026?
Not under that name. AWS states that on April 30, 2024, Amazon CodeWhisperer became a part of Amazon Q Developer. Q Developer then got its own end-of-support announcement on April 30, 2026: new signups were blocked from May 15, 2026, and the IDE plugins and paid subscriptions reach end of support on April 30, 2027. If you do not already have a subscription, you cannot start one.
Did Amazon use my CodeWhisperer code for training?
It depended on your tier, and the tier names have changed. Under the old CodeWhisperer split, the free Individual tier used code for service improvement unless you opted out, while Professional never did. Those names are retired. Current Amazon Q Developer tiers are Free and Pro at $19 per user per month. If you used the free tier years ago and never touched the opt-out, assume snippets were sent and treat any secret that was in those files as exposed.
What did CodeWhisperer's security scanning actually catch?
The feature survives in Amazon Q Developer as code reviews, powered by the Amazon Q detector library plus generative AI. It covers SAST findings like SQL injection and cross-site scripting, secrets detection, infrastructure-as-code misconfiguration, software composition analysis, and code quality. It reviews your git diff by default, not your whole project, so anything committed before you installed it was never looked at.
Is it true that GitHub Copilot has no security scanning?
That was the standard comparison point for CodeWhisperer and it is now out of date. GitHub's documentation says Copilot code review gives feedback on common issues including bugs and security vulnerabilities, with a Balanced mode intended for security-sensitive code. Neither tool is a substitute for a real scan, and GitHub says plainly that Copilot is not guaranteed to spot all problems.
What should I use instead of CodeWhisperer?
AWS points Q Developer IDE users at Kiro and publishes a migration guide. Whatever you pick, the assistant's built-in review only sees code you write while it is installed. Scan the deployed app from the outside for exposed keys, open storage buckets, and missing headers, because that is the class of problem no IDE plugin looks for.
Sources
- Amazon Q Developer rename, summary of changes (AWS documentation)
- Amazon Q Developer IDE plugins end of support (AWS documentation)
- Amazon Q Developer end-of-support announcement (AWS DevOps Blog, April 30, 2026)
- Reviewing code with Amazon Q Developer (AWS documentation)
- Using code references (AWS documentation)
- Amazon Q Developer pricing (AWS)
- Code review with GitHub Copilot (GitHub documentation)
Still running code an AI assistant helped you write?
Your IDE plugin reviewed the diff. It never looked at what you deployed. Scan your live app for exposed keys, open buckets, and missing headers.