Hacker News Reader

Called it.

The keys would be sniffed out by secret scanner anyway

https://docs.github.com/en/code-security/secret-security/abo...

Doesn’t make sense to implement fixes on CoPilot.

The stuff you write doesn't have to be commited to GitHub(or am I missing something?) so this argument makes no sense. Copilot clearly scanned and autocompleted third party secrets, it's in no way acceptable behaviour.

The Copilot FAQ has mentions about its training set.

https://copilot.github.com/

It's trained on public repos.

Public repos are scanned by the secret scanner. Why is it CoPilot's responsibiity to also scan the keys too?

Can you get these keys by searching via a search engine?

CommonCrawl contains considerable amount of PII information if you really spend time digging, for example.

Yes. There are quite a few services that scan Github and in realtime show leaked secrets. I once found someones Gmail password that way...

Reply on news.ycombinator.com