<p>Cutting off copilot for files that contain secrets is a good idea.  The risk that github gets hacked may be small, but it is still a risk that can be easily avoided so why take a chance?</p>
<p>Keep in mind that the more fundamental issue is that you should avoid having secrets in text files.  These are things that should be stored in vault and only retrieved for as long as they are needed.  Storing them on disk in any way should be avoided.  Presumably you are keeping your ansible code in a github repo and we have multiple recent examples of organizations that have had breaches of their repos.</p>

CC BY-SA 4.0
2023-02-08T10:54:00.853Z
I was going to answer this, but I don't need to as this answer is absolutely correct. You should not ever have secrets in text files. I tend to go even further than this though -- if a human has had access or could potentially gain access to information, then it's not a secret. Human access == unmonitorable disclosure risk == breach. Secrets only exist in the machine world; in the human world, there is only sensitive information with controls, which is not the same thing as secret.
Software Engineer
CC BY-SA 4.0
2023-02-07T18:40:41.410Z
2023-02-07T18:40:41.410Z
chicks
<p>I use VSCode and have recently started using GitHub Copilot for my projects (programming and devops related). I understand that Copilot will send parts of my text to a remote server to get suggestions etc. Some of those text is ansible inventory files which may contain URLs, paths, passwords and other secrets.</p>
<p>Is there a common consensus about this topic? Is this risky? Do people exclude specific file types with sensitive data from being read by copilot?</p>

<ansible><security><github><vscode>
Should I turn off copilot for text files containing secrets?
cherouvim
# Should I turn off copilot for text files containing secrets?

(Asked by: username_0 on 2023-02-02)

I use VSCode and have recently started using GitHub Copilot for my projects (programming and devops related). I understand that Copilot will send parts of my text to a remote server to get suggestions etc. Some of those text is ansible inventory files which may contain URLs, paths, passwords and other secrets.

Is there a common consensus about this topic? Is this risky? Do people exclude specific file types with sensitive data from being read by copilot?

**Tags:** ansible, security, github, vscode


---

## 1 answers

### Answer by username_1 on 2023-02-07. Score: 3

Cutting off copilot for files that contain secrets is a good idea. The risk that github gets hacked may be small, but it is still a risk that can be easily avoided so why take a chance?

Keep in mind that the more fundamental issue is that you should avoid having secrets in text files. These are things that should be stored in vault and only retrieved for as long as they are needed. Storing them on disk in any way should be avoided. Presumably you are keeping your ansible code in a github repo and we have multiple recent examples of organizations that have had breaches of their repos.

> **Comments:**
> **username_2**: I was going to answer this, but I don't need to as this answer is absolutely correct. You should not ever have secrets in text files. I tend to go even further than this though -- if a human has had access or could potentially gain access to information, then it's not a secret. Human access == unmonitorable disclosure risk == breach. Secrets only exist in the machine world; in the human world, there is only sensitive information with controls, which is not the same thing as secret.  

---

