Devtools-workspace adds 7 leak guards for GitHub Copilot

A practical tension is that once an internal AI agent is available, requests to feed it design documents and Excel files arrive quickly, but the same files are exactly what should not leak. Its answer is to stop relying on a written rule — the author notes that busy people forget warnings — and to move the protection into how the tools are built.

The route it maps is specific to Copilot: chat text, open files, and the files Copilot reads along with command results. From that, three policies follow — read only the necessary amount, keep body text and secrets out of tool output and logs, and mask anything that must not be sent before it goes out. The seven measures in the table are concrete instances of those policies, from running tools like doc2md and fieldcheck entirely on the PC, to a Masker that hides emails, Japanese phone numbers and key-like strings before any external send.

Alongside the tool-side work, an organization must confirm the AI service contract and internal rules, Copilot's admin content-exclusion setting for confidential folders and the out/ directory, keeping the repositories internal-only, and rehearsing with fictional data. It also flags prompt injection from document text as a risk that the rules reduce but do not fully eliminate.