Guide: Setting up a 'no-go' list of patterns to block certain Copilot suggestions.

Sure, you can block patterns, but the setup is clunky.

Look for "github.copilot.advanced" in your VS Code settings JSON. You define regex patterns there. But good luck if you have more than a few - it's a manual list you manage locally.

Bigger issue? This only blocks the *suggestion text* itself. It won't stop Copilot from generating the idea and you just typing it out from memory. You're treating a process problem with a filter.

So this is actually in the VS Code settings JSON like user638 said. You'd add something like:

"github.copilot.advanced": {
"pii": ["KEY_\d{5}", "OLD_MODEL_\w+"]
}

But I'm also new to this - do those patterns only apply to the suggestion's first line, or the whole multiline block? I'd hate to block a partial match inside a longer, valid suggestion. Has anyone tested that?

Yes, you can set up a pattern block in your VS Code settings. Go into your settings.json and look for the "github.copilot.advanced" section. You'll add patterns there, like the `KEY_12345` example you mentioned.

It's a helpful first layer, but it works on the suggestion text alone. This won't stop a developer from manually typing a blocked pattern if they recall it. For something like internal API keys, you should really pair this with a team process to rotate those keys and remove the old examples from your codebase entirely.

Does your team have a shared place where these outdated patterns are documented? Aligning on that list would make your filter much more effective.

Yes, it's absolutely true you can set up a 'no-go' list, and I've done this for similar email service placeholder keys. The setup is exactly as others described, in your VS Code settings.json under "github.copilot.advanced".

A key caveat I found with patterns like `KEY_12345` is that the matching is quite literal. If your old dummy keys sometimes used underscores or dashes inconsistently, you'll need a broader regex pattern to catch all the variations. I'd also recommend testing it with a few actual code snippets in your editor to see if it catches multiline suggestions properly - I've had mixed results there. This filter is a great safety net, but as others said, cleaning those patterns out of your training data (your actual code files) is the long-term fix. Have you done an audit of your templates to see how many files still contain those old keys?

Yes, it's configured in your VS Code settings.json under "github.copilot.advanced". You'll add a list of regex patterns there.

From my tests, the matching scans the entire suggestion block, not just the first line. So your `KEY_12345` pattern would trigger even if buried in a multiline snippet.

One practical tip: pair this with a simple script in your CI pipeline to grep for these patterns. It catches what Copilot misses when a developer types from memory.

Yes, that's a solid starting point. I'd add that the filter is a reactive guardrail, not a preventative one. It blocks suggestions containing the literal pattern, but it won't stop a developer from manually typing `KEY_12345` because they remember it from an old snippet.

For a more complete solution, consider tracking these patterns in your observability setup. You could add a custom log rule or a simple metric alert in Grafana to flag when these outdated patterns appear in your git commits, which catches what the local filter misses.

Good point about the regex for inconsistent key formats. In our code, we had a mix of `KEY_123`, `placeholder_key_456`, and `tempKey_789`. I ended up using a pattern like `[Kk][Ee][Yy].*d{3}` to catch most of them, but it still feels a bit fragile.

You mentioned auditing your templates - did you find a good way to systematically search and clean those old patterns? A simple grep across the repo works, but I've been wondering if there's a smarter way to handle it in a large, evolving codebase.

Exactly. The shared documentation step is key before you even touch the settings.json. My team runs a pre-commit hook that cross-references commits against a maintained blocklist file. It catches the manual typos the Copilot filter misses.

So the process is: agree on the list, scrub the repo, *then* set the local filter.

A pre-commit hook is a great idea! My team uses a simple bash script in our hook that just greps for patterns, but I'm a bit worried about false positives.

How do you handle it when a pattern like `KEY_` is part of a legitimate variable name, like in a migration file? Do you just make the regex super specific? 😅

Our CI is just gating on the grep output, so a false positive blocks the commit.

Yes, it's absolutely configured through VS Code's settings.json file under the "github.copilot.advanced" key, as others have started to point out. The setup process is straightforward, but I'd emphasize a crucial preliminary step that's often missed.

Before you edit a single config file, you need to audit your active codebase for the exact patterns you want to block. Copilot's training context is drawn from your project files, so if `KEY_12345` is still sitting in an old template somewhere, the filter is just putting a bandage on a leak. You'll have a cleaner result if you first run a systematic search-and-replace to remove those outdated structures from your actual source files. Then, the filter acts as a guardrail against residual memory in the model, not a primary defense.

For your specific example, a regex pattern like `KEY_d{5}` in the advanced settings would catch that exact dummy key format. Just remember that this only filters the suggestions as they pop up; it won't prevent a developer from manually typing that sequence from muscle memory. That's why the code audit is so important.

Yes, it's configured in your VS Code settings.json under "github.copilot.advanced". You add a list of regex patterns there, like `KEY_12345` or your old content model class name.

A practical caveat: this filter only works on the *suggestion text* itself. It won't stop the model from generating suggestions that *lead to* you writing those patterns manually. For something like an insecure API key format, you should really combine this with a pre-commit hook or a CI scan to catch the gaps in the local filter.

Good point about the filter only scanning the suggestion text. I've seen it miss the indirect cases too, like suggesting a code structure that's basically a template for you to fill in a bad key.

Combining it with a pre-commit hook is the only sane way. We pipe our hook's matches into a shortlist file for review, which cuts down on the false positive noise from CI blocks.

I've had good luck using a combination of `git log -p` and `grep` to see where those patterns were introduced, which helps with cleanup. It shows you the context of the commit, so you can tell if it was a template or a real piece of logic.

For the fragility, maybe try narrowing your regex? Something like `b(KEY|placeholder_key|tempKey)_d{3}b` might give you fewer surprises. The word boundaries help a lot with false positives in variable names.

Do you find the older patterns are mostly in dead branches or still active? That changes the cleanup strategy.

Oh, using `git log -p` for context is such a smart move. It turns the cleanup from a pattern hunt into a real investigation.

I like the word boundary tip for regex, that's saved me a lot of headache. One extra thing I do is stage the cleanup in CI. We run the stricter regex (with boundaries) in pre-commit, but our CI pipeline uses a slightly broader pattern just to log potential matches for review without blocking the build. That catches things that slip through the local filter without becoming a development bottleneck.

In our codebase, the worst offenders were in active, older utility files that everyone copies from for new projects. So they were very much alive and spreading.