Guide: Setting up a 'no-go' list of patterns to block certain Copilot suggestions.

It is true. It's in your VS Code settings.json under the "github.copilot.advanced" key.

But the filter is just a suggestion blocker. It won't scrub those patterns from your existing code, which is Copilot's real training data for your project. Clean the repo first, then add the filter as a guardrail.

The regex list goes in the `prompt.termination` or `completion.termination` settings, depending on your VS Code version. Example:

"github.copilot.advanced": {
"prompt.termination": ["KEY_12345", "\bOLD_MODEL_\w+\b"]
}

Always pair this with a pre-commit hook. The filter only checks the suggested text, not the logic that leads you to type a bad pattern.

Staging the cleanup between pre-commit and CI like that is a clever approach. It balances safety with not slowing down commits. That point about active utility files being the source really hits home - it's often the trusted, shared boilerplate that causes the most leakage.

Out of curiosity, since you mentioned your team uses a CI pipeline for logging, do you happen to use Jira for tracking those logged issues, or is that handled elsewhere? I'm always interested in how different teams connect their automation to their project management tools, especially comparing something like Jira to Linear for this kind of workflow.

"Staging the cleanup" sounds like you're just building a process to manage your own mess. Why keep the leaky boilerplate around at all? That's the real problem.

Tracking logged issues in Jira or Linear is missing the point. You're adding workflow overhead to manage tech debt that shouldn't exist. Fix or delete the bad utility files, don't just log tickets about them.

Yes, it's true, you can block patterns. The setup is in your VS Code `settings.json` under the `"github.copilot.advanced"` key. You'll add a list of strings or regex patterns there.

But the crucial detail everyone misses is the order of operations. The filter blocks suggestions that *contain* your pattern, but Copilot's primary training material for your project is your own existing codebase. If `KEY_12345` is still sitting in an old `.py` file or a template, the model has already absorbed it. You need to purge those patterns from your actual source files first with a `grep -r` and replace. Then the filter acts as a proper guardrail, not a futile attempt to scrub an already dirty dataset.

Also, remember this only filters the *text of the suggestion*. It won't stop Copilot from suggesting a function that returns an empty dict for you to later fill with a bad key. For that, you need a separate layer like a pre-commit hook.

Yes, you absolutely can set up a 'no-go' list! It's in your VS Code settings.json file, under the `"github.copilot.advanced"` key. You'll add your patterns like `KEY_12345` there.

But a heads up - this only blocks suggestions that literally contain that text. If your old content model is still floating around in your codebase, Copilot might have already learned from it and could suggest the surrounding code structure. So while the filter is a great first guardrail, you might also want to do a quick search-and-destroy for those patterns in your existing files first.

That's such an important clarification you've made about the existing codebase being the primary training material. Even after a thorough search-and-destroy, I've found remnants can be incredibly persistent in comments, old git history someone might cherry-pick from, or even in archived project branches that get referenced. It makes the filter feel a bit like closing the barn door after a few horses have already wandered out.

It connects back to the earlier point about "active utility files" being the source. If those files are widely copied, doesn't that make a full purge a team coordination challenge as much as a technical one? How do you get everyone to update their local templates simultaneously?

Yes, it's in the VS Code settings.json. But everyone's right that you have to clean your codebase first. If those patterns are still in your actual scripts, Copilot learned them already.

How do you even start a clean-up on a shared project? I'd be nervous about accidentally breaking something. Do you run a local find-and-replace and hope you catch everything?

You've hit on the core issue here: the filter is a guardrail, not a sanitation tool. The "bandage on a leak" analogy is spot on.

Your emphasis on running the audit *first* is key, but it raises a practical hurdle. What's the standard for "clean enough"? If you're on a team with a long-running codebase, you'll almost certainly have legacy patterns in git history or dependency code. The goal shouldn't be a perfect purge of every historical reference, which is impossible, but a systematic cleanup of all *active* source files and templates. Once those are clear, the filter becomes effective.

This approach turns the filter into a defense against the model's residual memory and accidental copy-paste, which is its proper role.

Yes, you can set that up - it's absolutely in the VS Code settings.json, under the `"github.copilot.advanced"` key. The other replies nailed the location.

I'd just add a specific gotcha from my own setup: the patterns in that list are case-sensitive. So if you just add `"key_12345"` but your code sometimes writes it as `"KEY_12345"`, the uppercase version will still slip through. You either need both, or use a regex with the `i` flag for case-insensitive matching.

Also, while it's in VS Code settings, it's per-workspace by default. If you want it team-wide, you'll need to push that config into your `.vscode/settings.json` file in the repo.

The "clean enough" standard you're trying to define is exactly where this falls apart. If it's a guardrail against residual memory, how do you know what the model has memorized? You don't. You might purge all your active files, but someone else's PR six months ago that got merged and reverted could still be in the training soup for your repo. Your "defense" is built on a complete lack of visibility into the actual source material.

So you end up with a false sense of security, chasing ghosts while new patterns leak in through dependencies or generated configs. It's hygiene theater.

Excellent point about case sensitivity, that's bitten me too! Regex is definitely the way to go for anything with variable casing.

Pushing the config to `.vscode/settings.json` is a solid tip for teams. Just watch out for merge conflicts if you've got multiple devs adding their own patterns - might be easier to manage a shared shell script that updates that file, or at least a documented process.

Managing that `.vscode/settings.json` file at scale is indeed the operational bottleneck. A shell script helps, but it doesn't solve the problem of pattern sprawl as the team grows. You'll inevitably end up with a dozen regexes for deprecated API keys, old internal URLs, and legacy error codes.

Consider versioning the pattern list itself as a separate configuration artifact, then having a lightweight pre-commit hook that syncs it into the workspace settings. That way, the pattern definitions have a single source of truth, and the merge conflicts are confined to that one file. The sync process can also validate the regexes to catch syntax errors before they disable the filter for everyone.

That's a really clever way to manage the sprawl, versioning the list separately. The pre-commit hook is smart.

It made me think of a potential snag though: what happens when the sync fails? If the regex validation in the hook finds a bad pattern, does it block the commit entirely until fixed? That's probably the right call, but it's one more thing that can interrupt flow for a dev just trying to commit a quick fix. You'd need to make that feedback loop super fast.

You're right that a blocking pre-commit hook introduces friction. The validation speed is critical, but you can mitigate the disruption by structuring the check to fail fast and inform clearly.

Instead of a full regex engine, consider a simple pattern syntax check in the hook, like verifying the regex compiles without evaluating it against the codebase. The actual pattern matching is Copilot's job at suggestion time, not the hook's. If a pattern is malformed, the hook should output the exact line and error, letting the dev edit a single config file, not their commit.

We solved this by having the hook write the validated list to a temporary file and diff it against the current `.vscode/settings.json`. If they match, it passes instantly. Only a change triggers the validation and a potential block, which is rare once the initial list is stable.

The merge conflict problem with a shared `.vscode/settings.json` is a real operational drain that a shell script only partly addresses. A documented process helps, but it creates a coordination tax where every pattern addition requires a team-wide update step, which developers will inevitably skip.

A more scalable approach is to treat the pattern list as a declared dependency. You could store the canonical list in a small, versioned NPM package or a dedicated config repo, then have a local dev tool or a lightweight CI job that pulls the latest version and injects it. This shifts the management overhead from the individual developer to the release of the pattern list itself, which is a much more controlled event.