GitHub Copilot is safe to use, but the code it suggests is not automatically secure. Copilot completes patterns from its training data, and that data contains insecure code, so it will confidently suggest hardcoded credentials, string-concatenated SQL, and missing input validation. Independent research found a large share of Copilot-generated code contained security weaknesses, so its output needs the same review as any AI code.
From our scan data
GitGuardian found repos with Copilot active leaked a secret 40% more often than public repos overall.
The risks that actually matter
Suggested hardcoded credentials
When you are wiring up an API client, the highest-probability completion is often a literal key, because that is what Copilot learned from. It has even been shown to reproduce real-looking secrets on request.
Insecure code patterns
SQL built by string concatenation, missing output encoding that opens cross-site scripting, and absent input validation are common in generated code.
Prompt injection via config files
Hidden instructions in files Copilot reads can steer its suggestions, a risk unique to assistant workflows.
How to secure a GitHub Copilot app
- Turn on GitHub secret scanning with push protection.
- Add a secrets rule to .github/copilot-instructions.md.
- Review generated queries, input handling, and auth on new routes.
- Install a gitleaks pre-commit hook to block inline keys.