Question

A security engineer at your company wants to prevent GitHub Copilot from ever reading a file named 'secrets.env' that stores API keys. They add it to the repository's content exclusion configuration and ask you whether this now guarantees the file's contents can never appear as context in any Copilot feature. What is the most accurate response about the protection and its limitations?

Accepted Answer

Content exclusions best-effort prevent Copilot from using the file as context in completions and chat, but they are not a substitute for a secrets-management solution, and admins should still avoid storing plaintext secrets in the repo.

Answer

Once excluded, the file is cryptographically sealed so that no Copilot component, IDE plugin, or third-party tool can ever access its bytes under any circumstance.

Answer

Content exclusions only apply to the code-referencing/public-code matching filter, so the file must instead be added to the duplicate-detection allowlist to be protected.

Answer

Content exclusions automatically encrypt the file at rest in the repository, which is why secrets stored there are safe to leave in plaintext.