Working habits
Settings can’t cover everything, so these habits cover the rest:
- Read untrusted content first: instruction-like text in an issue, pull request, file name or README is the attack, and that includes opening a Codespace from an issue.
- Treat changes to
.vscode/,.github/and instruction files as security events, whether you or the agent made them. - Keep production credentials out of your environment: an agent can’t misuse a token it can’t see.
- Don’t rely on content exclusions: they don’t apply in agent mode (GitHub docs).
- Put project rules in
.github/copilot-instructions.md: they shape the code Copilot writes, but only approvals, trust and the sandbox enforce anything.