Security, governance, and network settings for GitHub Copilot

You can prevent Copilot from accessing certain files.

Understand what session data is, where it is stored, who can access it, and how it is managed.

Local sandboxes provide isolated execution environments that let Copilot safely interact with code, tools, filesystem, and network resources securely on your local machine.

When local sandboxing is enabled, Copilot CLI runs each sandboxed process or operation under a filesystem policy that controls which files and directories it can read and write. Learn how that policy is built and how to check the access it grants.

Cloud sandboxes are isolated environments that GitHub hosts, where Copilot runs your cloud sessions without using your machine.

How do Copilot cloud agent's built-in security protections mitigate known risks?

You can connect to GitHub Copilot through an HTTP proxy and use custom certificates.