GitHub's responsible-use page states generated code may contain vulnerabilities and should be reviewed and tested before merging.
GitHub Copilot suggests and edits code inside your own project and can work as a coding agent in a GitHub Actions environment. It does not choose your stack or host your app. GitHub's responsible-use page states that generated code may contain vulnerabilities and should be reviewed and tested.
The relevant patterns are the ones that show up in generated code across any stack. One Copilot-specific note comes from Snyk's research: the assistant uses open files as context, so an existing flaw can be repeated in new code. Secret scanning, code scanning with Autofix and Copilot code review are GitHub's own tools for the first pass.
Each row is taken from the vendor's documentation on the date shown. Defaults change; the date is the claim.
| Area | Default | Source |
|---|---|---|
| Frontend | Copilot suggests and edits code in the developer's own project; it does not choose a stack or host apps. Capabilities depend on plan, client and organization policy. | docs · verified 2026-09-21 |
| Coding agent environment | The cloud coding agent works in an ephemeral GitHub Actions environment, in a single repository and branch, with a 59-minute maximum per task. | docs · verified 2026-09-21 |
| Branch and workflow controls | The agent can only push to the existing PR branch or a new copilot/ branch, never directly to the default branch; Actions workflows triggered by its PRs need approval from a user with write access. | docs · verified 2026-09-21 |
| Network access | By default the coding agent's internet access is limited by a firewall with a recommended allowlist (package registries, container registries, certificate authorities). | docs · verified 2026-09-21 |
| Secrets / env vars | Secret scanning runs automatically and free on public repositories for hardcoded credentials; private repositories need GitHub Team or Enterprise Cloud with Secret Protection. | docs · verified 2026-09-21 |
| Data use for training | From April 24, 2026 GitHub may use Copilot Free, Pro, Pro+ and Max interactions to train models unless the user opts out in settings; Business and Enterprise data is not used for training. | docs · verified 2026-09-21 |
Documentation home: docs.github.com/en/copilot
52 patterns in the catalogue name GitHub Copilot; the most severe are listed here across secrets and keys, data access, login and permissions, payments. Attribution is descriptive: the default stack makes the pattern reachable, or a public incident names it.
The build writes the secret's value into public JavaScript, so anyone who loads the site can read it, and a redeploy with the same variable name republishes it.
Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted.
Anyone who opens the app can copy the key from the downloaded JavaScript and read, change or delete every row in every table.
Anyone with the app's public Firebase config, which sits in its JavaScript, can read, overwrite or delete the entire database and storage bucket without signing in.
Anyone who changes the id in a URL or request can read, edit or delete another customer's record.
Signed-out visitors or other customers can read rows meant for one account, while the owner sees an empty page and nobody notices.
Anyone who creates a free account can page through every other customer's records, which is a data breach with a sign-up form as the only step.
Anyone with the project URL and the public anon key, both of which sit in the app's JavaScript, can read, edit or delete every row in the table.
The table looks protected in the dashboard, yet any visitor with the public anon key can read, insert, update and delete every row.
A stranger who types /admin or /api/admin into the address bar can see or change everything the owner can.
Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.
Anyone who reads the code or guesses a common placeholder can sign in as the administrator.
Anyone can write their own token naming another user, or an admin, and the server will act as that person.
A visitor who edits the signup request, or updates their own profile, can make themselves an admin.
Anyone who finds the webhook URL can post a made-up payment-succeeded event and get an order fulfilled or a plan activated for a user of their choosing, without paying.
Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.
Apr 2026 · Lovable · all sources
One education app built on Lovable had 16 vulnerabilities, 6 critical; a database function denied callers whose role was 'authenticated', so anonymous callers passed and 18,697 user records were readable without login.
Feb 2026 · Taimur Khan · all sources
A scan of 1,645 Lovable-built apps found 170 (about 10.3%) with database endpoints readable without login because Supabase row-level security policies were missing or too broad; recorded as CVE-2025-48757, CVSS 9.3.
May 2025 · Matt Palmer (Replit, Inc.) · all sources
Moltbook, a social network for AI agents built with AI-generated code, ran a Supabase database without row-level security policies, leaving 1.5 million API tokens and 35,000 email addresses readable and writable without login.
Feb 2026 · Wiz Research · all sources
Each entry links to its primary source in the evidence list. What to do about it is the self-check below.
Stated from the vendor's documentation. The limits are the vendor's scope statements, not judgements.
Copilot Autofix for code scanning
Generates fix suggestions with explanations for CodeQL alerts on pull requests and the default branch; allowed by default for every repository using CodeQL, across nine languages.
Where it stops: Best-effort: the docs state it may not produce a fix for every finding, may suggest fixes at incorrect locations, and every suggestion needs developer review.
vendor docs · verified 2026-09-21
Copilot code review
Reviews pull requests in any language for bugs, security vulnerabilities and style issues; available on Business, Enterprise, Pro and Pro+.
Where it stops: The docs state Copilot can miss problems in a pull request and that its feedback should be supplemented with a human review.
vendor docs · verified 2026-09-21
Coding agent firewall
Limits outbound internet access from the agent's Actions environment and warns when a request is blocked; allowlists are managed at organization and repository level.
Where it stops: Applies only to processes started by the agent via Bash inside the Actions environment; does not cover MCP servers or setup steps, and the docs say it is not a comprehensive security solution.
vendor docs · verified 2026-09-21
Content exclusion
Repository, organization or enterprise settings can list files and paths Copilot should ignore.
Where it stops: Agent mode in Copilot Chat in IDEs does not support content exclusion; changes can take up to 30 minutes to apply.
vendor docs · verified 2026-09-21
The critical patterns first. Each uses the dashboard and your browser.
.env files, list every variable whose name starts with NEXT_PUBLIC_.NEXT_PUBLIC_ variable holding a server-only key, or a search hit for that key's value in a loaded script..env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.sk_live, sk-, service_role, BEGIN PRIVATE KEY and password=.git log --all -p -S sk_live -- . | head. Any output means a live key has been committed at some point.service_role and then for sb_secret_.supabase.co, and read the apikey header under Request Headers.GitHub Copilot pre-launch checklist
52 checks, in the order we run them. Usable without buying anything.
Self-check tool
Answer questions about your app and get the patterns that apply, ordered by severity. Runs in your browser; nothing is sent.
For founders about to let real users in.
$490
For anyone who wants the three riskiest areas checked fast.
$290
All packages and prices. Every report includes a re-check after your fixes.
We test the application Copilot helped write: permission checks, secrets, database rules, payments and error handling, from the outside with two accounts and from the repository. GitHub's code scanning and Copilot code review catch known patterns in the diff; a running test catches logic that is wrong for your app.
Research on the evidence page measured higher rates of security issues in AI co-authored changes in the samples studied, and Snyk showed Copilot repeating a flaw from a neighbouring file. Neither means your code is broken; both mean the flows that matter deserve a test before launch.
GitHub documents secret scanning, Dependabot, code scanning with Copilot Autofix, a firewall for the coding agent and content exclusion. Turn on secret scanning and Dependabot at minimum, then test the running app.