Copilot's Context Engine Doesn't Know What a Secret Is

Point mitmproxy at VS Code, trust the certificate, and GitHub Copilot stops being a magic autocomplete and becomes what it actually is: a context-harvesting pipeline with a network connection. A teardown that hit the Hacker News front page this week did exactly that, and the most damning capture wasn't exotic. While the author edited pyproject.toml, Copilot's completion request shipped a secret from their .env file — a file they weren't touching — because the client bundles context from recently edited files into every request. Up to 20 files, with as many as 8 edit summaries each, ride along with your prompt.

None of this is a breach, and none of it violates GitHub's documented behavior. That's precisely the problem. The privacy boundary of an AI coding assistant isn't defined by a policy document; it's defined by context-assembly heuristics that change with every release, that you can't see, and that — on individual plans — you mostly can't configure.

Context got greedy because context is the moat

If you've followed this space, the direction of travel is unmistakable. When Parth Thakkar reverse-engineered the Copilot client in late 2022, the payload was modest: your cursor's neighborhood plus snippets from a handful of open tabs, scored by a Jaccard-similarity window. By mid-2025, Serge van den Oever's mitmproxy session showed chat requests carrying full conversation history and user-configured instruction blocks. This latest capture adds recent-edit diffs across the workspace, an intent-classification endpoint that routes each prompt (code-gen, debugging, reasoning, tool-use) before model selection, and a local SQLite session store the model can introspect with SQL.

The reason is competitive, not careless. Frontier models are converging in raw capability — as one HN commenter put it, every high-end LLM performs about as well "maybe with an extra detour." What separates Copilot from Cursor from Windsurf is how much relevant state each can assemble per request. Context is the product now. And a context engine optimized to win benchmarks has exactly zero incentive to be conservative about what it scoops up. Recent edits are one of the strongest relevance signals available, so of course the client sends them. The engine doesn't know — can't know, client-side, without dedicated machinery — that one of those recently edited files was your secrets file.

The controls exist, just not for you

Here's the part that should actually change purchasing decisions. GitHub ships a fix for exactly this failure mode: content exclusion lets you blocklist paths like .env so they neither get suggestions nor inform suggestions elsewhere. It's available on Copilot Business and Enterprise only. On Free, Pro, and Pro+, you get a model-training opt-out and feature toggles — nothing that constrains what context leaves your machine. There's no .gitignore integration, no default exclusion for dotfiles, no client-side secret scrubbing on individual plans.

Even where content exclusion exists, read the fine print: it doesn't apply to symlinks or repositories on remote filesystems, and it can't stop the IDE from leaking semantic information — type signatures, hover definitions — about excluded symbols. It's a policy filter bolted onto a pipeline that was designed to maximize collection, and it behaves like one.

The local story is arguably worse. The teardown found Copilot's chat sessions persisted in a plaintext SQLite database (session-store.db) — every prompt and response, unencrypted, no scrubbing. The author verified it by pasting a fake GitHub token into chat and pulling it back out with a SELECT. That claim is single-source, but the methodology is trivially reproducible, and it fits how VS Code extensions typically handle state. If it holds, every secret you've ever pasted into Copilot Chat is sitting on disk where any infostealer that already greps for .aws/credentials and browser cookie jars will eventually learn to look.

Treat your editor as an exfiltration surface

The actionable conclusion isn't "ditch Copilot." It's that AI-era editors have quietly become semi-trusted network clients, and deserve the same skepticism you'd apply to any agent with filesystem read access and an outbound socket. Concretely:

• Verify, don't trust. The audit costs an afternoon: run mitmweb, set http.proxy to http://localhost:8080 and relax http.proxyStrictSSL in VS Code, restart the extension host, and read your own traffic. Do it for whichever assistant you use — this class of behavior is not Copilot-specific, and vendors' data-handling pages won't tell you what the client actually sends this month.
• Get secrets out of files the context engine can see. Plaintext .env in the workspace root was always a soft target; now it's actively being sampled. Inject secrets at runtime from a manager (1Password CLI, Infisical, Vault) or run agents in containers that simply don't mount them.
• If you're on a team plan, configure content exclusion today. It's an org/repo admin setting, it's not on by default, and its gaps (symlinks, remote filesystems) mean it complements — doesn't replace — keeping secrets out of the tree.
• If you're evaluating assistants for a security-conscious org, make context controls a line item. Ask vendors what leaves the machine, what's stored locally and in what format, and what's configurable at which tier. Copilot gates the answer behind Business; most competitors don't answer at all.

My read: this teardown is the strongest argument yet that the industry's context arms race has outrun its safety tooling. Client-side secret redaction — entropy scanning and pattern matching before bytes leave the machine — is a solved problem; every CI vendor does it in log output. That it's absent from the most widely deployed AI coding tool, while the closest substitute is sold as an enterprise upsell, is a choice. Until vendors treat context assembly as a security boundary rather than a growth metric, the proxy is your only honest changelog.