How to use it
- Once at setup, work through sections A to G.
- Fix every P1 item before doing any work on company code. P2 items close important gaps; P3 items are good practice.
- Items with an audit check ID are verified automatically by the Copilot Security Audit. Re-run it monthly and after every VS Code or extension upgrade. Items without one are confirmed by hand.
- Keep the completed checklist with your saved audit report as your assessment record.
A. Installation and identity
| # | Check | Priority | Audit check |
|---|---|---|---|
| A1 | VS Code is 1.132.1 or later (CVE-2026-70335), and Visual Studio 2022 is 17.14.26 or later where used. | P1 | I01 |
| A2 | The GitHub Copilot Chat extension is 1.123.2 or later (CVE-2026-45482). | P1 | I02 |
| A3 | The Copilot CLI is current, and its automatic updates stay on. | P2 | manual |
| A4 | Work code runs under your organisation's Copilot Business or Enterprise seat, so its policies apply. | P1 | manual |
B. Approvals and trust
| # | Check | Priority | Audit check |
|---|---|---|---|
| B1 | chat.tools.global.autoApprove (and the old chat.tools.autoApprove) is off, enforced with the ChatToolsAutoApprove policy where possible. | P1 | V02 |
| B2 | chat.permissions.default is "default"; Bypass Approvals and Autopilot are chosen per session only. | P2 | V03 |
| B3 | chat.tools.terminal.autoApprove lists only read-only commands, with no shells, deletes, network tools or /.*/ patterns. | P1 | V04 |
| B4 | chat.tools.edits.autoApprove doesn't cover **/*, .vscode/, .github/, .env or lockfiles. | P2 | V05 |
| B5 | Workspace Trust is on, and folders you didn't create open in restricted mode. | P1 | V06 |
| B6 | chat.tools.urls.autoApprove has no wildcard entries. | P2 | V10 |
C. Sandbox and the Copilot CLI
| # | Check | Priority | Audit check |
|---|---|---|---|
| C1 | The VS Code agent terminal sandbox is on (chat.agent.sandbox.enabled: "on") with chat.agent.sandbox.allowNetwork set to false. | P1 | V07 |
| C2 | The Copilot CLI sandbox is on (sandbox.enabled in ~/.copilot/settings.json). | P1 | L01 |
| C3 | permissions.disableBypassPermissionsMode is "disable", and no alias or export adds --yolo, --allow-all or COPILOT_ALLOW_ALL. | P1 | L04, S01 |
| C4 | Saved approvals in ~/.copilot/permissions-config.json are reviewed, and allowedUrls has no wildcards. | P2 | L02, L03 |
D. Extensions: MCP servers, plugins and extensions
| # | Check | Priority | Audit check |
|---|---|---|---|
| D1 | Every MCP server in VS Code and the CLI is approved and pinned to a version. | P1 | M01, M03 |
| D2 | Servers that read content outsiders write (errors, tickets, chat, email) have read-only scopes. | P2 | M02 |
| D3 | chat.mcp.discovery.enabled is false. | P3 | V09 |
| D4 | Extensions and plugins come only from your organisation's allowlist (AllowedExtensions policy) and their updates are reviewed. | P2 | manual |
E. Repositories
| # | Check | Priority | Audit check |
|---|---|---|---|
| E1 | Before trusting a folder, its .vscode/settings.json is checked for agent, trust and sandbox settings. | P1 | P01 |
| E2 | Project MCP servers in .vscode/mcp.json, .mcp.json and .github/mcp.json are reviewed. | P1 | P02, P03, P04 |
| E3 | Instruction files (.github/copilot-instructions.md, .github/instructions/, AGENTS.md, CLAUDE.md, agents and prompts) are read, and checked for hidden Unicode. | P1 | P05, P06 |
| E4 | .github/hooks/ and .github/copilot/settings.json are read before the Copilot CLI runs in the repository. | P1 | P08, P12 |
| E5 | Symlinks are listed and none points at .vscode/, .github/ or a dotfile. | P1 | P10 |
| E6 | Repositories that arrive with their own .git/config are checked for core.hooksPath, core.fsmonitor and filter drivers. | P2 | P11 |
| E7 | .env files are gitignored. | P2 | P09 |
F. Copilot cloud agent
| # | Check | Priority | Audit check |
|---|---|---|---|
| F1 | The cloud agent is enabled only on repositories with branch protection and a required second reviewer. | P1 | manual |
| F2 | Only issues a person has read are assigned to Copilot. | P1 | manual |
| F3 | The agent firewall is on, with additions only for what a build needs. | P1 | manual |
| F4 | "Approve and run workflows" is still required for the agent's pull requests. | P1 | manual |
| F5 | copilot-setup-steps.yml pins actions by SHA and downloads no scripts. | P2 | P07 |
| F6 | Cloud agent MCP servers come from the organisation's allowlist, list only the tools they need, and receive only COPILOT_MCP_ secrets they need. | P2 | manual |
G. Working habits
| # | Check | Priority | Audit check |
|---|---|---|---|
| G1 | Instruction-like text in issues, pull requests, file names and READMEs is read by a person before Copilot acts on it, and Codespaces aren't opened from unread issues. | P1 | manual |
| G2 | Secret scanning with push protection is on for every repository you work in. | P1 | manual |
| G3 | Agent pull requests are reviewed like outside contributions, lockfiles and dependency URLs included. | P1 | manual |
| G4 | No production credentials in the environment Copilot runs in. | P1 | manual |
| G5 | Content exclusions are not relied on to hide files from agent mode. | P2 | manual |
| G6 | Suspicious agent behaviour is reported to the security team the same day. | P2 | manual |
Sources
- VS Code and GitHub documentation: AI settings reference, Tool approvals, Agent sandbox, Enterprise policies, Copilot CLI configuration, Cloud agent risks and mitigations.
- Incidents behind sections E, F and G: see the Common Copilot Misconfigurations.
Informational only, with no guarantee of a vulnerability-free setup, so test every configuration in your own environment. AISecurityLabs.org is independent and not affiliated with GitHub or Microsoft. Setting names change often, so check them against the reference for your version.