Hi everyone, new here and still learning the ropes of evaluating dev tools for my team. 😅
We're exploring GitHub Copilot to help speed up development, and the idea of it generating boilerplate code is really appealing. One area where it seems like a huge time-saver is with authentication flows—things like login functions or API key validation.
But as someone who isn't a security expert, I'm getting a bit nervous. Our CTO asked if we could rely on code Copilot suggests for anything security-sensitive. I've seen it generate code snippets that *look* correct, but I don't have the depth to know if there are hidden flaws.
Has anyone in the community done, or come across, a formal security review of the authentication code Copilot generates? I'm thinking about things like:
* Does it consistently suggest parameterized queries to prevent SQL injection?
* How does it handle password hashing? Does it default to strong, modern algorithms?
* Could it inadvertently suggest broken or outdated OAuth flows?
A blog post or even an internal report you could summarize would be incredibly helpful. I'm trying to put together a simple risk assessment for our procurement process, and firsthand experiences would be gold.