Security, governance, and network settings for GitHub Copilot

You can prevent Copilot from accessing certain files.

Understand what session data is, where it is stored, who can access it, and how it is managed.

Cloud and local sandboxes provide isolated execution environments that let Copilot safely interact with code, tools, filesystem, and network resources securely on your local machine or in fully isolated cloud environments.

When local sandboxing is enabled, Copilot CLI runs each sandboxed process or operation under a filesystem policy that controls which files and directories it can read and write. Learn how that policy is built and how to check the access it grants.

How do Copilot cloud agent's built-in security protections mitigate known risks?

You can connect to GitHub Copilot through an HTTP proxy and use custom certificates.