Keep .env Away From Copilot: Content Exclusion Is GA in App and CLI, and the Gaps It Leaves

On 2026-09-02 GitHub’s changelog announced that content exclusion is generally available in the GitHub Copilot app and the Copilot CLI. The operative sentence: Copilot will not use excluded files as context.

This is worth a how-to rather than a news recap, because in most teams the reality is that .env, secrets.json, private keys and sample customer data are sitting in the repo while an agent walks the whole directory. So: the steps you can follow, and then the section that matters more than the steps — the gaps GitHub itself documents.

1. First, check whether you even have this switch

The docs are explicit: content exclusion is a Copilot Business and Copilot Enterprise feature.

Individual Copilot Free, Pro, Pro+ and Max plans do not have it. On an individual plan, the only protection is not putting secrets in the workspace in the first place. We compared the plans here: what Copilot free and paid actually differ on.

2. The three configuration paths

Exclusion rules exist at three levels, narrowest first:

Practical advice: set the company-wide patterns at the organization or enterprise level. If you configure .env once per repository, you will miss the hundred-and-first repository.

3. The YAML, ready to copy

Repository level is a plain list, one path per line:

# Things Copilot may not read in this repo
- "/.env"
- "/config/credentials.yml"
- "/src/some-dir/kernel.rs"

Organization and enterprise level name repositories, and support the wildcard key:

# "*" covers every repository, and locations outside Git
"*":
  - "**/.env"
  - "**/*.pem"

octo-repo:
  - "/src/some-dir/kernel.rs"

https://github.com/primer/react.git:
  - "secrets.json"

That "*" key is the important one. GitHub’s docs say it covers all repositories and non-Git locations — that is, files a developer has open locally that belong to no repo at all. For most teams, that single key is the whole point.

4. Matching rules: fnmatch, case-insensitive

The docs state that paths use fnmatch notation and that patterns are case insensitive. Common forms:

The most common mistake is writing only /.env, which silently misses apps/api/.env and packages/web/.env.local. In a monorepo, always anchor with the any-depth form and list the variants:

"*":
  - "**/.env"
  - "**/.env.*"
  - "**/*.pem"
  - "**/*.key"
  - "**/id_rsa"

(The .env.* variant is our extrapolation from the documented fnmatch behaviour; GitHub’s examples do not enumerate it. Verify it with the test in section 6.)

5. It takes up to 30 minutes

This is the number one reason people conclude “the setting does nothing”. The docs say changes take up to 30 minutes to apply in IDEs. To apply them now:

• JetBrains / Visual Studio: close and reopen
• VS Code: Command Palette → Developer: Reload Window
• Vim / Neovim: applied when the file is opened

The docs also note that repository URLs are sent to GitHub servers to fetch the right policy, but are not logged anywhere.

6. Verify it yourself

Never assume a policy works because you saved it.

1. Type a few lines inside an excluded file and confirm inline suggestions do not appear at all.
2. Open Copilot Chat and ask for something that only lives in that file. Confirm it cannot quote the contents.
3. Reload the window before testing, or you are testing the policy from 30 minutes ago.

7. The section that matters: what it still does not cover

All of the following comes from GitHub’s own documentation, not from us:

1. Agent mode in Copilot Chat in IDEs does not support content exclusion. VS Code’s Edit and Agent modes do not respect exclusions either. The scenario you worry about most — an agent reading the entire workspace on its own — is exactly the weakest spot.
2. Semantic information can still leak indirectly. The docs say Copilot may use semantic information from an excluded file if the IDE supplies that information indirectly.
3. Symlinks and repositories on remote filesystems are not currently supported. Linking a secrets directory into the workspace effectively bypasses exclusion.

Surface support is also uneven. Inline suggestions are covered in Visual Studio, VS Code, JetBrains, Vim/Neovim, Xcode and Eclipse, but chat and agent coverage exists only in VS Code, Visual Studio, JetBrains and on GitHub’s web and mobile apps. Xcode, Eclipse and Azure Data Studio have no chat-side support.

So model it correctly: content exclusion is a policy layer that reduces accidental ingestion. It is not a vault. Real secrets still belong outside the repo — injected as environment variables or held in a secret manager — and still need rotating.

8. A three-step rollout

1. Set one "*" rule at the enterprise level covering **/.env, **/*.pem and **/*.key. That protects every repository at once.
2. Add repo-specific paths for data samples, customer exports and sensitive source directories.
3. Tell the team that agent mode is not covered. That gap has to be closed by human process: do not run whole-repo agent tasks over sensitive directories.

Copilot has been shipping fast on this line — the same week also brought Copilot code review approving pull requests, whose switches and cost bands we covered here.

9. What we could not verify

• A maximum number of exclusion rules: not stated on the pages we checked. Unverified.
• Whether the app and CLI still differ from IDEs after GA: the changelog says only that they now respect the policies, with no per-surface table. Unverified.
• Whether existing indexes or embeddings are purged retroactively once a rule is added: not documented. Unverified.
• Whether individual plans will ever get this: no announcement. Unverified.

Official links

• GitHub Changelog (2026-09-02): https://github.blog/changelog/2026-09-02-content-exclusions-generally-available-in-copilot-app-and-cli
• Content exclusion concepts, including the limits: https://docs.github.com/en/copilot/concepts/context/content-exclusion
• Configure content exclusion (YAML and paths): https://docs.github.com/en/copilot/how-tos/configure-content-exclusion/exclude-content-from-copilot

Related

• GitHub Copilot tool page (plans and quota verification log)
• What Copilot free and paid actually differ on
• Copilot code review can now approve your PR