A team excluded a secrets folder, then relies on Agent mode. What is the risk?
Why B is the answer
Content exclusion is not supported in Edit and Agent modes
GitHub states that it is not currently supported in Edit and Agent modes of Copilot Chat in VS Code and other editors. Secrets do not belong in a repository anyway.
In detail
- Content exclusion is not supported in Edit and Agent modes.
- A team relying on it there is exposed, so use other controls too.
- Keep real secrets out of the repository.
Use case
An illustrative scenario, not a real incident.
A team excludes a secrets folder, then uses Agent mode. Exclusion is not supported there, so the files are not protected in that mode.
See it in different ways
flowchart TD A["Content exclusion"] --> B["Applies: supported chat and completions"] A --> C["Applies: code review on GitHub"] A --> D["Not supported: Edit and Agent modes"] A --> E["Not guaranteed: third-party MCP servers"]
stateDiagram-v2 [*] --> Excluded Excluded --> Respected: inline suggestions and chat Excluded --> NotSupported: Edit and Agent modes Excluded --> NotGuaranteed: third-party MCP servers Excluded --> Indirect: IDE semantic information
flowchart TD
Q{"Which mode?"}
Q -->|"Edit or Agent"| A0["Exclusion is not supported"]
Q -->|"Features that support it"| A1["Exclusion applies"]Key point: Content exclusion does not cover Edit and Agent modes.
Why the other options are wrong
- A. Agent mode will refuse to start in any repository that has exclusions set
- Agent mode does not refuse to start.
- C. Agent mode will publish the excluded files in a public repository
- It does not publish files.
- D. There is no risk, because exclusions apply the same way in every mode
- Exclusions do not apply the same way in every mode.