2

I use VSCode and have recently started using GitHub Copilot for my projects (programming and devops related). I understand that Copilot will send parts of my text to a remote server to get suggestions etc. Some of those text is ansible inventory files which may contain URLs, paths, passwords and other secrets.

Is there a common consensus about this topic? Is this risky? Do people exclude specific file types with sensitive data from being read by copilot?

Improve this question

1 Answer 1

Reset to default
3

Cutting off copilot for files that contain secrets is a good idea. The risk that github gets hacked may be small, but it is still a risk that can be easily avoided so why take a chance?

Keep in mind that the more fundamental issue is that you should avoid having secrets in text files. These are things that should be stored in vault and only retrieved for as long as they are needed. Storing them on disk in any way should be avoided. Presumably you are keeping your ansible code in a github repo and we have multiple recent examples of organizations that have had breaches of their repos.

Improve this answer
1
  • 1
    I was going to answer this, but I don't need to as this answer is absolutely correct. You should not ever have secrets in text files. I tend to go even further than this though -- if a human has had access or could potentially gain access to information, then it's not a secret. Human access == unmonitorable disclosure risk == breach. Secrets only exist in the machine world; in the human world, there is only sensitive information with controls, which is not the same thing as secret.
    – Software Engineer
    Commented Feb 8, 2023 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.