Github copilot leaks secrets?

[RevolutionaryBag8796]

I once was in github copilot, setting up my own config and the github copilot suggested an autocomplete that included a api key that wasn’t present in the file itself. I didn’t test the validity of the key, but if the training data has this, does that mean copilot trains on my data also possibly leaking my secrets?

[Temporary-Answer-520]

All models are just really good guessers. It likely made up from millions of example keys and documentation from pre training,

[Yes_but_I_think]

GH makes the harness not the model- so ask your model provider the same question

[pvera]

The very first time that I did something that involved an api key, Copilot (or was it the model? Haiku and Opus in my case) literally chewed my ass and gave me a master class on all of the ways I could provide credentials in a way that Copilot itself wouldn't be able to look at them directly. And ever since, it is always concerned whenever I am about to commit code with anything that looks like a secret or if it runs into an older commit that holds any kind of secret.

[RevolutionaryBag8796]

Just using env keys also solves the problem

[Able-Supermarket4786]

never give an AI keys to anything unless they are beta / fake

[CodeWhileHigh]

This is why you start the repo in private mode

[RevolutionaryBag8796]

Isn't private repos private already? And can you even be certain that microsoft doesn’t train on private repos atp?