GitHub has expanded its content exclusion policies for Copilot, offering more granular control for enterprise users while highlighting ongoing limitations with remote and linked file exclusions, prompting organisations to adopt layered security measures.
GitHub has expanded content exclusion in Copilot, with the company saying on 2 September 2026 that the Copilot app and Copilot CLI now honour administrator-defined policies set at enterprise, organisation and repository level. The change is generally available for Copilot Business and Copilot Enterprise customers, and it closes a gap in coverage for two agentic workflows that had not previously been included.
The practical effect is that excluded files should no longer be used as context when Copilot responds or generates suggestions in the covered clients. GitHub’s documentation says the same control also applies to inline suggestions and code review, although support on GitHub.com and GitHub Mobile remains in public preview. The company is careful to frame content exclusion as a context-selection control rather than a broader security boundary.
That distinction matters. GitHub says content exclusion is not supported in Edit and Agent modes in Copilot Chat, including in Visual Studio Code and other editors. The documentation also says an IDE may still surface semantic information derived from excluded files, such as type details, hover definitions or build settings, which means administrators cannot treat exclusion as a substitute for repository permissions, secret management or network controls.
There are also explicit structural limits. According to GitHub’s documentation, content exclusions do not apply to symbolic links or repositories on remote filesystems. That means a successful test on a normal local file does not automatically prove protection for linked paths, network-mounted workspaces or other remote-backed development setups. In effect, the new coverage is narrower than the headline may suggest.
Independent implementation guidance published on 3 September 2026 recommends a canary approach for validation, using harmless marker files rather than real secrets. The method compares responses for an excluded file and a control file, then repeats the same check across the app, CLI, supported editor modes and, where relevant, code review. It also advises treating symlinks, remote filesystems and IDE-derived semantic data as separate test surfaces, since a passing result in one path does not prove coverage in another.
For security teams, the update is still significant. It extends centrally managed exclusions into more of the Copilot workflow, giving administrators tighter control over what content may influence AI responses in covered environments. But the remaining exceptions mean organisations should continue to rely on layered controls, especially where sensitive code can be reached through links, remote workspaces or editor features that may leak derived context.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
