Copilot writes every prompt you type into a plaintext SQLite file
Reading the source tells you what an app can do. Running it through a man-in-the-middle proxy tells you what it actually does. Rafael did the second thing to GitHub Copilot and the writeup hit the Hacker News front page today with 139 points.
The finding people are reacting to is a local SQLite database called session-store.db. Every user message and every assistant response goes in, in plain text. He tested it the obvious way — dropped fake GitHub tokens, AWS keys and database passwords into chat messages — and every one landed in the file exactly as typed. No redaction, no masking. There is no default rule protecting .env contents; secret filtering only happens through enterprise repository policy, which is not something an individual developer has.
The rest of the teardown is a good look at how much context a modern coding agent actually ships. Up to 20 recently edited files with 8 edit summaries, conversation history, repository info — all bundled per request. And before generating anything, Copilot classifies your prompt against intent categories like code generation, debugging and reasoning, then routes to a model based on that. Everyone suspected the routing; here is the wire traffic.
His conclusion is the line worth stealing: context is becoming the product. Copilot is a stateful system that stitches workspace, edits, conversations, tools and history together, and the differentiation has moved from model quality to how well you assemble that pile. Which is also why the SQLite finding matters beyond the privacy angle — if context assembly is the product, every vendor is building exactly this kind of local history store, and almost none of them are telling you what's in it. Copilot just happens to be the one somebody proxied.
https://www.lighthousenewsletter.com/p/i-put-github-copilot-behind-a-mitm
← Back to all articles
The finding people are reacting to is a local SQLite database called session-store.db. Every user message and every assistant response goes in, in plain text. He tested it the obvious way — dropped fake GitHub tokens, AWS keys and database passwords into chat messages — and every one landed in the file exactly as typed. No redaction, no masking. There is no default rule protecting .env contents; secret filtering only happens through enterprise repository policy, which is not something an individual developer has.
The rest of the teardown is a good look at how much context a modern coding agent actually ships. Up to 20 recently edited files with 8 edit summaries, conversation history, repository info — all bundled per request. And before generating anything, Copilot classifies your prompt against intent categories like code generation, debugging and reasoning, then routes to a model based on that. Everyone suspected the routing; here is the wire traffic.
His conclusion is the line worth stealing: context is becoming the product. Copilot is a stateful system that stitches workspace, edits, conversations, tools and history together, and the differentiation has moved from model quality to how well you assemble that pile. Which is also why the SQLite finding matters beyond the privacy angle — if context assembly is the product, every vendor is building exactly this kind of local history store, and almost none of them are telling you what's in it. Copilot just happens to be the one somebody proxied.
https://www.lighthousenewsletter.com/p/i-put-github-copilot-behind-a-mitm
Comments