Configure Privacy, Content Exclusions & Safeguards

Configuration Scopes

What Gets Excluded

When a file matches an exclusion rule, Copilot:

• Does not provide inline code completion suggestions when editing that file
• Does not use that file's content as context in Copilot Chat (excluded files won't appear as references)
• Does not send the excluded content to Copilot's servers

Pattern Syntax — fnmatch (case-insensitive)

Exclusion paths use fnmatch pattern matching notation:

Example Configuration Syntax

Repository-level (one path per line):

# Exclude secrets and config files
secrets.json
secret*
*.cfg
**/.env
/scripts/**

Organization/Enterprise-level (YAML, keyed by repo):

"*":
  - "**/.env"

my-repo:
  - "/src/internal/kernel.rs"
  - "secrets.json"

https://github.com/org/repo.git:
  - "/PATH/TO/FILE"

Propagation & Verification

• Changes to exclusion rules take up to 30 minutes to propagate to IDE clients
• To force refresh in VS Code: Command Palette → Developer: Reload Window
• To force refresh in JetBrains / Visual Studio: close and reopen the IDE
• In Vim/Neovim: exclusions are fetched automatically when a file is opened
• Verification method: Open an excluded file → attempt an edit that normally triggers suggestions → no suggestions should appear
• For Chat verification: open the excluded file as context → prompt "explain this file" → the file should not appear in the references list

API Management

• Org and enterprise owners can manage exclusions programmatically via the Copilot REST API
• Useful for automating exclusion rule deployment at scale

Editor-Level User Settings

• VS Code: github.copilot.enable setting — can be set per language (e.g., disable for *.md)
• JetBrains: Toggle in Copilot settings with language-specific controls
• Telemetry: Individual/Pro users can opt in/out of sharing usage data
• Training data: Free/Pro/Pro+/Max users can opt in/out of having their data used to train Copilot models; Business/Enterprise: data is never used for training

Who Owns AI-Generated Code?

• GitHub does not claim ownership over Copilot-generated suggestions
• Responsibility for the code lies with the developer who accepts and commits it
• Suggestions may resemble existing open-source code — licensing must be considered
• Enable duplication detection to identify suggestions matching public code
• IP indemnity coverage varies by plan — consult your Copilot agreement

Limitations to Remember

• No guarantee that suggestions are original, unique, or free of vulnerabilities
• Suggestions are not legal advice — review for compliance independently
• Organizations should establish written AI usage policies for developers
• Copilot cannot guarantee correctness — only the developer's validation can

"Suggestions Matching Public Code" (Duplication Detection / Code Referencing)

The exam guide names this policy "suggestions matching public code filtering" — Copilot compares a suggestion plus ~150 characters of surrounding code against public code on GitHub, and can block or allow matches:

• Personal accounts configure this individually — unless they belong to an org/enterprise, in which case the setting is inherited and the personal option is unavailable
• Org/enterprise admins configure it under Settings > Copilot > Policies
• When blocked, the suggestion is filtered before reaching the user
• Exception: Copilot coding agent does not support Block mode for this policy — matches are highlighted in the session logs instead of being suppressed
• Note: if this policy is set to Block and no suggestions appear, that is expected behaviour — know this for troubleshooting questions

Security Warnings

• Copilot includes safety filters to detect potentially insecure code patterns
• Suggestions with known vulnerability patterns may be flagged or suppressed
• Complements — but does not replace — GitHub's dedicated security tools (Dependabot, Secret Scanning, Code Scanning / SAST)
• Always run dedicated security tooling in addition to Copilot's built-in checks