GitHub Copilot Security: Control Code Leaving the IDE
See the code and secrets that VS Code, JetBrains and the terminal send to GitHub Copilot. Tell personal Copilot accounts apart from the company plan.
- GitHub Copilot
- ChatGPT
- Microsoft Copilot
- Google Gemini
- Claude
- Allow & log
- Redact
- Block
- Deny app
Risks of GitHub Copilot use
Code sent as context
Copilot sends snippets from open files to produce suggestions. These snippets can hold .env values or API keys.
Personal plan
a developer can use company code with a personal Copilot Free or Pro account. Company policies then do not apply.
Agent mode
Copilot agent mode can run terminal commands and read files. The context it sends grows.
Recommended AI Control policy
Scope: Windows, macOS and Linux devices with the Moftgate agent. Personal phones without the agent are out of scope.
- 01
IDE application type × GitHub Copilot: Allow & log.
- 02
When secret key, password or connection string classifications match: Block.
- 03
Unapproved IDE extensions or CLI tools × all providers: Deny app.
Allow & log
The prompt is sent and recorded.
Redact
Matched data is masked and the masked prompt is sent.
Block
The prompt is not sent and the event is recorded.
Deny app
The app cannot talk to this provider at all.
Questions about GitHub Copilot
Details are based on policies published by GitHub (Microsoft) and public reports. Plans and settings can change; check current terms with the vendor.
See your GitHub Copilot use in one week
AI Control logs prompts and masks or blocks sensitive data. Data stays on your own servers.