What Is GitHub Copilot?
An AI pair programmer from GitHub/Microsoft that provides inline code completions and chat-based code generation in VS Code, JetBrains, and other IDEs. Copilot uses OpenAI Codex models trained on public code repositories to suggest code in real-time as developers type.
Security Risks
Copilot’s training on public repositories means it has learned both secure and insecure patterns:
- Reproduces vulnerable patterns: Trained on code that includes known vulnerabilities
- Insecure defaults: Often suggests the simplest implementation without security considerations
- License concerns: May reproduce code from GPL/copyleft repositories
- Stale patterns: Training data may include deprecated APIs with known security issues
- Missing context: Inline completion lacks full project awareness, leading to inconsistent security
- Test quality: Generated tests often test happy paths without security edge cases
Security Checklist
- Enable Copilot’s built-in vulnerability filtering (blocks known insecure patterns)
- Review all completions before accepting, especially for auth and data handling
- Verify that suggested packages exist and are not typosquatting
- Check database queries for injection vulnerabilities
- Ensure error handling does not expose sensitive information
- Validate that authentication and authorization logic is complete
- Test generated code with security-focused test cases
- Run SAST tools on all Copilot-generated code
- Check for hardcoded credentials in suggestions
- Verify that suggested APIs are not deprecated or known-vulnerable
Frequently Asked Questions
Does Copilot generate code with vulnerabilities?
Research from Stanford found that approximately 40% of Copilot-generated code contained security vulnerabilities. GitHub has since added vulnerability filtering, but studies continue to find security issues in AI-generated completions. Always review and test Copilot suggestions.
Can Copilot reproduce copyrighted code?
Yes. Copilot can reproduce verbatim code from its training data, including GPL-licensed code. GitHub offers Copilot Business customers a filter that blocks suggestions matching public code and an IP indemnity program. Individual users should verify licensing of accepted suggestions.
Is Copilot better with GitHub Advanced Security?
GitHub Advanced Security (GHAS) provides code scanning, secret scanning, and dependency review that complement Copilot. Using both together catches many of the security issues Copilot introduces. GHAS is free for public repositories and paid for private repos.