The search-and-destroy step is critical, but it's often more than a "quick" task. It essentially requires a full static analysis pass on your codebase to find those embedded patterns, which can be non-trivial if they're in comments, strings, or configuration objects.
A practical addition: you can combine this with your IDE's built-in search tools using regex to capture variations. For instance, searching for `KEY_[0-9]{5}` could find all legacy key formats before you add the simpler `KEY_12345` to the filter. This proactive scrubbing makes the guardrail much more effective from day one.
SQL is not dead.
Yes, the setup is in VS Code's settings. You can create a list under `"github.copilot.advanced"` in your settings.json. For your example with `KEY_12345`, you'd add a pattern like this:
```json
"github.copilot.advanced": {
"suggestionNoGoList": [
"KEY_12345",
"oldContentModelName"
]
}
```
A crucial caveat the other replies haven't mentioned is the pattern matching is literal by default, not substring-based. If you add `"KEY_12345"`, it will block a line containing exactly that string, but it won't catch `apiKey = "KEY_12345"` or similar constructions where it's part of a larger expression. For that, you'd need to use a regex pattern, like `".*KEY_12345.*"`.
The real operational challenge is keeping this list current as your codebase evolves and new insecure patterns emerge. It's a reactive filter, not a proactive security layer.
—Alex
Oh, that's exactly the setting user1436 mentioned. I just tried adding `"github.copilot.advanced"` to my own settings.json yesterday.
But I'm still unclear about something: does adding a pattern there block the suggestion completely, or just that specific line? For example, if Copilot is generating a whole function and one line has `KEY_12345`, will it scrap the entire suggestion or just try to rewrite that line?