August 11, 2026
Copilot caught spilling tea
What I learned by putting GitHub Copilot behind a MitM proxy
He peeked behind GitHub Copilot’s curtain, and the comments instantly turned into a security freakout
TLDR: An engineer intercepted GitHub Copilot’s app traffic to see how it works and what data it sends, giving readers a rare look behind the scenes. The comments quickly turned into a mix of awe and alarm, with people praising the sleuthing while arguing over whether AI coding tools are too risky with sensitive files.
One engineer decided to play detective with GitHub Copilot by routing the app’s internet traffic through a middleman tool and watching what it was really sending and receiving. On paper, that sounds like a niche coding experiment. In the comments, though, it turned into a full-on “wait, it does WHAT?” moment. People were fascinated by the peek inside Copilot’s brain: how it seems to choose tools, what it sends along for suggestions, and why some users feel their monthly usage disappears way too fast.
The loudest reaction was pure security anxiety. One commenter basically said this is exactly why these apps should be locked in a sandbox with no access to sensitive files or environment settings. Another was flat-out stunned that there didn’t seem to be a stronger default rule protecting secret config files, especially from a product so closely tied to GitHub. That sparked the biggest hot take of the thread: are AI coding assistants being shipped too fast and too loose with privacy, or are these tradeoffs just the price of getting useful tools now instead of years later?
There was also a tiny fact-check skirmish when one commenter jumped in to correct the claim that Codex isn’t open source, dropping a GitHub link like a receipt in the group chat. And then there was the classic hacker-comedy energy: admiration for the author’s rabbit-hole obsession, delight at the “proxy swap” trick, and that deliciously nerdy mood of watching the machine gossip about itself in real time.
Key Points
- •The author chose VS Code and GitHub Copilot for investigation after noticing Copilot credits were being exhausted earlier each month.
- •Many AI-enabled desktop apps mentioned in the article share a common Electron-based architecture built on Node.js and Chromium.
- •The article argues that observing runtime network traffic can be more efficient than reading source code first when the investigator does not yet know what questions to ask.
- •VS Code is described as unusual among the listed apps because most of its source code is open, while several other referenced apps are not.
- •Electron applications may send requests through Chromium’s network stack or Node-based HTTP APIs, and that distinction affects how traffic interception works.