GitHub Copilot security: code, agents, and secrets

Copilot's capabilities

• Code completion and chat in the editor, using the open files and repository context.
• Agent mode in the IDE, which can plan multi-file changes and propose or run terminal commands, subject to the developer's approval settings.
• The Copilot coding agent, which can be assigned an issue, work in a cloud environment, push to a branch, and open a pull request for review.
• Extensions and MCP servers that connect Copilot to other tools and data sources.

GitHub offers individual plans and organization plans (Business and Enterprise) with policy controls, content exclusion settings, and audit logging. Individual plans used on company code bypass those controls.

What Copilot can access

Copilot works with the code and files available in the developer's environment and, for the coding agent, the repository it is assigned to. That can include configuration files, test fixtures with real data, infrastructure-as-code, CI/CD workflow definitions, and — too often — committed secrets.

Key risks

Secrets in context

If API keys, database credentials, or tokens exist in the repository or local files, an AI assistant can read them and may reproduce them in suggestions, logs, or pull requests. The fix is not an AI setting; it is keeping secrets out of code.

Commands executed in agent mode

When agent mode can run terminal commands, the developer's machine credentials — cloud CLI sessions, kubeconfig contexts, SSH keys — are within reach of whatever command is run. Auto-approving commands removes the human check.

Prompt injection through issues, code, and dependencies

Issue descriptions, code comments, documentation, and dependency READMEs are untrusted input. A malicious issue assigned to a coding agent can attempt to induce changes beyond the requested task.

Unreviewed changes and CI/CD

AI-authored changes to workflow files can alter what runs in CI with repository secrets. Changes to branch protection or CODEOWNERS weaken review for everything else.

Personal plans on company code

Developers using individual Copilot plans on organization repositories operate outside your policies, exclusions, and audit logs.

Recommended controls

• Use an organization Copilot plan and set policies centrally; disallow individual plans on company repositories.
• Enable secret scanning and push protection; rotate any secret ever committed.
• Configure content exclusion for sensitive paths where supported.
• Protect default branches: required reviews, CODEOWNERS for workflows and infrastructure, no bypass for bot identities.
• Require human review of every pull request opened by the coding agent.
• Keep production credentials off developer machines; use short-lived, least-privilege credentials.
• Keep command auto-approval off in agent mode, or restrict it to a narrow allow-list.
• Review which MCP servers and extensions are permitted.

How FlashTower assesses this

When you add GitHub Copilot to a FlashTower Scan, the Risk Engine evaluates how it is actually used in your organization — account type, data accessed, capabilities, autonomy, credentials, logging, and vendor terms — against a versioned, deterministic ruleset. These rules are the most relevant for GitHub Copilot. Each fires only when its stated condition is met. See how scoring works.