Security safeguards and best practices when using AI assistance in development.

Audience: All developers using AI assistance | Prerequisites: Understanding of MCP integrations

Reference: GitHub Copilot Trust Center

Your Code → MCP Server → External Service → AI Model

Always:

• Use .env for secrets, never commit
• Use .gitignore to exclude sensitive files
• Use local MCP servers when possible
• Understand what data flows to which services

Learn more: MCP Integrations – Detailed data flow diagrams

Organizations should configure GitHub Copilot at the enterprise/organization level for maximum security:

Configure these patterns at the organization level to prevent sensitive data from being processed:

# Recommended exclusions (configure in GitHub org settings)
**/.env*
**/secrets.yaml
**/secrets.json
**/*.pem
**/*.key
**/customer_data/**
**/credentials/**

Important: Exclusions filter content before it leaves the developer's machine—this is a robust data leak prevention mechanism.

• Standard audit logs record who used Copilot and when, but not what was asked (privacy by design)
• For organizations requiring prompt auditing, integrate with Microsoft Purview or similar DSPM tools
• Code review (Pull Requests) remains the primary control for reviewing AI-generated output

Reference: GitHub Copilot Trust Center

Understanding the unique threats introduced by AI-assisted development:

New to MCP? The Model Context Protocol allows AI agents to access external tools and data. Learn how this project uses MCP and understand the security implications when you grant agents permissions.

Configuration: See Custom Agents for agent tool restrictions

Configuration: Custom Agents – Complete agent permission matrix

When MCP servers connect to external services:

Sensitive data from one project appears in another.

An MCP server should never accept tokens not explicitly issued for it.

// ❌ DANGEROUS: Passing through external tokens
server.use(req.headers.externalApiToken)

// ✅ CORRECT: Validate token audience
const token = validateAudience(req.token, 'mcp-server-id')
if (!token.valid) throw new AuthError('Invalid audience')

Rule: MCP servers must validate all tokens were issued specifically for them.

When evaluating new MCP servers or tools, use quantitative risk scoring:

$$R_{total} = \sum (A_{tool} \times S_{tool} \times D_{tool})$$

Risk Thresholds:

• 0.0 - 0.25: Auto-approve eligible
• 0.26 - 0.5: Requires session approval
• 0.51 - 0.75: Requires per-action confirmation
• 0.76 - 1.0: Deny by policy

📖 Full framework with examples: See the Security Review Skill

This project includes a hardened Dev Container configuration (.devcontainer/devcontainer.json) that provides:

Getting Started: See the README for setup instructions.

The project configures these security settings in .vscode/settings.json:

Use this checklist when onboarding or auditing AI-assisted development setup:

• Using Copilot Business or Enterprise plan (not Individual)
• Public Code Matching Filter set to "Block"
• User Feedback Collection disabled
• Content Exclusions configured for .env*, secrets, credentials
• Using Enterprise Managed Users (EMUs) if available

• Workspace Trust enabled (security.workspace.trust.enabled: true)
• Default to Restricted Mode for new/unknown folders
• Extension allowlist implemented (only approved extensions)
• MCP discovery disabled (chat.mcp.discovery.enabled: false)
• MCP auto-approval disabled (chat.mcp.autoApprove.enabled: false)

• All local servers use stdio transport (not HTTP with network port)
• No credentials hardcoded in mcp.json (use ${env:VAR} syntax)
• Each MCP server documented with risk rating
• External MCP servers use OAuth or short-lived tokens

• Dev Containers used for AI-assisted projects
• Container runs as non-root user
• Credential scanning in pre-commit hooks
• Dependencies regularly audited (npm audit)

If an agent performs unexpected actions:

• MCP Integrations – MCP server security configuration
• Custom Agents – Agent permission boundaries
• Developer Responsibilities – Code review practices

• OWASP Top 10 – Most critical web application security risks
• OWASP Top 10 for LLMs – AI/LLM-specific security risks
• Model Context Protocol Docs – MCP security guidelines
• GitHub Copilot Trust Center – Enterprise security features
• Prisma Security Best Practices – Database security

• Setting up secure development environment? → See Environment Isolation
• Onboarding or auditing AI setup? → Use the Operational Security Checklist
• Need to configure agent permissions? → Custom Agents
• Setting up MCP servers? → MCP Integrations
• Not sure if you should review something? → Developer Responsibilities
• Planning a new feature with security implications? → Consult security team before implementation