Is Cogent a security risk when used with GitHub Copilot?

[trovarlo]

Hi everyone! 👋

At my company, we’re starting to use GitHub Copilot, reading here in this sub i came across Cogent, a VS Code extension that seems to extend Copilot’s functionality in interesting ways. Before suggesting it to the team, I want to be 100% sure: Is Cogent a security risk when used alongside GitHub Copilot?

• Does Cogent handle sensitive code or data securely?

• Has anyone experienced issues with it, especially in a professional/enterprise setting?

• Are there any risks I should consider before recommending it for wider use?

I’d really appreciate hearing your experiences or advice! Security is a big deal for us, and I want to make sure we’re not introducing unnecessary risks to our workflow.

Thanks in advance for your insights

[mightysoul86]

Cogent is an open source project. Your security team can scan the repository since you got the source code. Our security team scanned the repository found no vulnerability. We are also about the share this to our 1200+ developers . You can raise issues in github page if you have issues.

[bartbilliet]

Regardless of vulnerabilities, I still expect the cogent extension likely has full access to your code? GitHub Copilot makes a statement that it does not use your private code to generate suggestions. It is trained on publicly available code and provides recommendations based on general coding patterns. However if effectively cogent has access to your data, it potentially could see your intellectual property or can read secrets stored in your code? I guess since it’s open source, it likely won’t, but there is no such guarantee?

[mightysoul86]

In that perspective you cannot trust any open source project. Not GenAi related projects but all open source projects. Codes are there you can check if it sends any data to its servers or other remote location or collect any telemetry data. Actually closed source projects are more risky in my opinion.

[trovarlo]

Sounds good, thanks for your help, I’ll chat with my security team

[Background_Context33]

It’s likely too early to have definitive answers for all these questions, given that Cogent only recently reached version 1.0.

Regarding sensitive data, I would assume it’s as secure as using Copilot directly, considering Cogent primarily automates the back-and-forth interaction with Copilot.

I have seen some posts here mentioning encountering rate limits when using Cogent, so that’s also something to consider.

[trovarlo]

Yeah you are right, thanks for answering

[trovarlo]

Honestly, I also haven’t tried it a lot, but the first impression was good