--- title: What I learned by putting GitHub Copilot behind a MitM proxy description: A hands-on investigation into GitHub Copilot's network traffic using mitmproxy reveals how the tool operates before a single keystroke. Key findings include:... canonical: https://daily.dev/posts/what-i-learned-by-putting-github-copilot-behind-a-mitm-proxy-xpcklqdlp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What I learned by putting GitHub Copilot behind a MitM proxy | daily.dev og:description: A hands-on investigation into GitHub Copilot's network traffic using mitmproxy reveals how the tool operates before a single keystroke. Key findings include:... og:url: https://daily.dev/posts/what-i-learned-by-putting-github-copilot-behind-a-mitm-proxy-xpcklqdlp og:image: https://api.daily.dev/og/posts/xpcKLqDlP.png og:image:alt: What I learned by putting GitHub Copilot behind a MitM proxy og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What I learned by putting GitHub Copilot behind a MitM proxy **[Hacker News](https://daily.dev/sources/hn)** · 17 min read · 0 upvotes · 0 comments ## Summary A hands-on investigation into GitHub Copilot's network traffic using mitmproxy reveals how the tool operates before a single keystroke. Key findings include: Copilot's Auto mode routes prompts through an intent classifier to select models; a 'recently edited files' sliding window (up to 20 files, 8 edit summaries, 3 lines of context) can inadvertently include secrets from .env files in API requests even when Copilot is disabled for .env; and Copilot's Chronicle feature stores all chat turns—including user messages with any secrets typed—in a local unencrypted SQLite database (session-store.db) with no scrubbing or redaction. The source code confirms these behaviors are deliberate. The broader takeaway is that AI coding tools are becoming stateful systems where context assembly is the real product differentiator, but this raises serious privacy and data confidentiality concerns. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does GitHub Copilot store my chat history in plaintext locally? Yes, Copilot's Chronicle feature stores full chat turns, including user messages and assistant responses, in plaintext inside a local SQLite database called session-store.db, located under VS Code's globalStorage for github.copilot-chat. There is no redaction, sanitization, or masking in the write path, so secrets like tokens or connection strings pasted into chat are saved exactly as typed. _Anyone auditing what an AI coding assistant retains locally can compare findings like this on daily.dev before trusting it with sensitive code._ ### Can GitHub Copilot inline completions leak secrets from a .env file even if .env completions are disabled? Yes, because Copilot's recent-edits context window pulls up to 20 recently edited files, 8 edit summaries, and 3 lines of context around each change, and this window is not gated by per-file completion settings or .gitignore rules. So editing an unrelated file like pyproject.toml can still send a diff snippet from a previously edited .env file to the completion API, even with .env completions turned off. _Developers weighing AI assistant context risks can track findings like this on daily.dev before enabling inline completions on sensitive repos._ ### What tool does GitHub Copilot use to query past coding session history, and how does it work? Copilot's Chronicle feature exposes a session_store_sql tool that runs read-only SQLite queries (SELECT and WITH only) against local tables named sessions, turns, session_files, session_refs, checkpoints, and search_index. The model does not know the schema in advance; it first queries sqlite_schema to introspect table definitions before issuing a working query, using SQLite-specific syntax like datetime('now', '-1 day') and FTS5 MATCH for text search. _Engineers designing similar agent memory tools can compare this session-store approach on daily.dev when building their own harness._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 25 comments across hackernews (as of 2026-09-14). **TL;DR:** Commenters find the MitM investigation genuinely interesting and technically informative, especially the .env secret-leakage and unencrypted SQLite findings, though discussion quickly branches into eBPF interception techniques and practical mitigations rather than deep criticism of Copilot itself. **Sentiment:** 35% positive · 40% mixed · 25% skeptical **The case for** - The eBPF/uprobe approach is highlighted as a powerful, certificate-pinning-resistant alternative for intercepting TLS traffic from AI coding tools. - The investigation surfaces concrete, reproducible findings (sliding-window context, SQLite session store) that help developers understand what data leaves their machines. - Running AI coding tools in sandboxes without environment access is reinforced as a practical defensive measure. **The pushback** - Copilot can inadvertently include secrets from .env files in API requests even when the file type is supposedly excluded, with no built-in scrubbing. - The Chronicle session store persists all chat turns—including any secrets typed—in a local unencrypted SQLite database with no redaction. - There is skepticism that data-retention clauses or LLM instructions alone can reliably prevent secret exposure, since the model cannot be fully trusted to follow them. - Copilot's episodic memory design loses intermediate context from multi-step tasks, limiting its usefulness for complex problems. **By community** - hackernews (mixed): Broadly appreciative of the technical depth, with lively side-threads on eBPF interception methods and practical secret-management alternatives, but genuine concern about the .env leakage and unencrypted session store. **Hottest debate:** Whether eBPF uprobes or a MitM proxy is the cleaner method for intercepting TLS traffic from statically-linked AI tool binaries. **Open questions** - Is there a cross-platform, coding-agent-agnostic solution to prevent .env secrets from leaking into AI tool context? - Can data-retention clauses or in-prompt instructions ever be reliably enforced when the LLM itself cannot be fully trusted? - Does encrypting or scrubbing the local Chronicle SQLite database require a policy change from GitHub, or can users configure it themselves? **Highlights** > I was curious to understand how Copilot implements its harness, and also how I was exhausting my quota so quickly. End up going down a rabbit hole of intercepting its network traffic with mitmproxy. A few interesting things I found along the way: - watched model/capability discovery and routing happen in real time - looked at what gets injected into context and sent with ghost completions - found that recent edits can pull in context from files other than the one you're currently editing (including infamous .env) - found the SQLite session store behind Chronicle, including previous prompts/responses - watched the model query that history through tool calls I then went through the VS Code source to reconcile some of what I was seeing on the wire with the actual implementation. Overall some interesting lessons around how their harness is implemented. > — [j0selit0 on hackernews · 1 comments](https://news.ycombinator.com/item?id=49256392) > One thing I found that I thought was a fun addition, is using eBPF made this even easier. No need to fight with anyone that is using certificate pinning, mTLS or anything else, you just get the raw plaintext data straight of the wire (right before encryption and right after decryption) and works nicely for most of the agents and IDE's. That will in practice give you everything from telemetry to prompts, and its funny to see just how much some of them collect/run that is not at all related to your own ask.. A handy alternative when certain applications tend to make it harder to apply a MiTM proxy and you can dump it straight into your own scripts/programs to filter out and store it in whichever format you want for more analysis. > — [p1llus on hackernews · 2 comments](https://news.ycombinator.com/item?id=49260152) > How do you actually cleanly solve that .env issue? Anything cross platform and coding agent agnostic? I suppose that .env file should be removed, but then things aren’t easy: no native multiplatform secret manager, or the std lib of the language doesn’t offer an API over the native secret store, etc. > — [jiehong on hackernews · 4 comments](https://news.ycombinator.com/item?id=49264313) > Nice deep dive, I always wondered how copilot worked compared to similar tools. I'm shocked at the lack of of a rule for env files, I at least thought with a tool more integrated with github as a whole that would be a default but alas. > — [tolugenius on hackernews](https://news.ycombinator.com/item?id=49258637) > Data retention clauses? I dont see how you can ever really trust an LLM anyway to follow instructions. > — [sandos on hackernews](https://news.ycombinator.com/item?id=49264592) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49256057) · 149 points · 25 comments ## Similar posts on daily.dev - [Copilot: Faster, smarter, and built for how you work now](https://daily.dev/posts/copilot-faster-smarter-and-built-for-how-you-work-now-t13qa8ggt) · GitHub Blog · 0 upvotes · 0 comments - [Reverse Engineering GitHub Copilot: What Every AI Product Manager Can Learn](https://daily.dev/posts/reverse-engineering-github-copilot-what-every-ai-product-manager-can-learn-l0nf4chfi) · Medium · 0 upvotes · 0 comments - [How GitHub Copilot Uses MCP Tools Behind the Scenes](https://daily.dev/posts/how-github-copilot-uses-mcp-tools-behind-the-scenes-nyhtlcknl) · This is Learning · 2 upvotes · 0 comments --- Tags: [#github](https://daily.dev/tags/github), [#reverse-engineering](https://daily.dev/tags/reverse-engineering), [#electron](https://daily.dev/tags/electron) [View this post on daily.dev](https://daily.dev/posts/what-i-learned-by-putting-github-copilot-behind-a-mitm-proxy-xpcklqdlp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What I learned by putting GitHub Copilot behind a MitM proxy","url":"https://daily.dev/posts/what-i-learned-by-putting-github-copilot-behind-a-mitm-proxy-xpcklqdlp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-i-learned-by-putting-github-copilot-behind-a-mitm-proxy-xpcklqdlp"},"datePublished":"2026-08-11T15:38:39.913Z","dateModified":"2026-09-14T07:54:07.436Z","description":"A hands-on investigation into GitHub Copilot's network traffic using mitmproxy reveals how the tool operates before a single keystroke. Key findings include:...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/47c338830eeb871ada5895433df499e0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/47c338830eeb871ada5895433df499e0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-i-learned-by-putting-github-copilot-behind-a-mitm-proxy-xpcklqdlp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"github,reverse-engineering,electron","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"What I learned by putting GitHub Copilot behind a MitM proxy"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-i-learned-by-putting-github-copilot-behind-a-mitm-proxy-xpcklqdlp#faq","mainEntity":[{"@type":"Question","name":"Does GitHub Copilot store my chat history in plaintext locally?","acceptedAnswer":{"@type":"Answer","text":"Yes, Copilot's Chronicle feature stores full chat turns, including user messages and assistant responses, in plaintext inside a local SQLite database called session-store.db, located under VS Code's globalStorage for github.copilot-chat. There is no redaction, sanitization, or masking in the write path, so secrets like tokens or connection strings pasted into chat are saved exactly as typed. Anyone auditing what an AI coding assistant retains locally can compare findings like this on daily.dev before trusting it with sensitive code."}},{"@type":"Question","name":"Can GitHub Copilot inline completions leak secrets from a .env file even if .env completions are disabled?","acceptedAnswer":{"@type":"Answer","text":"Yes, because Copilot's recent-edits context window pulls up to 20 recently edited files, 8 edit summaries, and 3 lines of context around each change, and this window is not gated by per-file completion settings or .gitignore rules. So editing an unrelated file like pyproject.toml can still send a diff snippet from a previously edited .env file to the completion API, even with .env completions turned off. Developers weighing AI assistant context risks can track findings like this on daily.dev before enabling inline completions on sensitive repos."}},{"@type":"Question","name":"What tool does GitHub Copilot use to query past coding session history, and how does it work?","acceptedAnswer":{"@type":"Answer","text":"Copilot's Chronicle feature exposes a session_store_sql tool that runs read-only SQLite queries (SELECT and WITH only) against local tables named sessions, turns, session_files, session_refs, checkpoints, and search_index. The model does not know the schema in advance; it first queries sqlite_schema to introspect table definitions before issuing a working query, using SQLite-specific syntax like datetime('now', '-1 day') and FTS5 MATCH for text search. Engineers designing similar agent memory tools can compare this session-store approach on daily.dev when building their own harness."}}]} ```