Public Code Matches and IP Indemnity
Litware has 300 Copilot Business seats. The organization setting for suggestions matching public code is set to Block. A developer complains that Copilot refuses to suggest a 12-line StringBuilder-based CSV escaper that the team has written before, and asks to switch the setting to Allow so the suggestion appears. Legal is interested because the company sells proprietary software and also maintains two open-source repositories under the same enterprise. The security team wants a decision that preserves GitHub's IP indemnity if possible. The developer argues that the snippet is 'obviously generic' and that blocking it costs time. The platform team has no process for reviewing public-code matches, and no one has checked which licenses are involved.
1. Explain what the duplication detection filter compares and what changes when the setting moves from Block to Allow.
Read the worked answer
What the filter does.
The duplication detection filter compares a generated suggestion against public code available to GitHub and flags suggestions that match. When the organization setting is Block, a matching suggestion is not shown. When it is Allow, the suggestion can be shown along with a match indicator and, where available, repository and license information. The filter is not a global internet code scanner, and it is not a license-compliance tool; it is a guardrail against reproducing known public code.
What changes with Allow.
The risk moves from prevention to review. With Block, the developer never sees the match and cannot accidentally paste it. With Allow, the developer must notice the match, open the details, check the license, and decide whether the use is compatible with the repository's license and the company's policy. In practice, many developers will accept the suggestion without checking. That is why Allow requires a process, not just a setting change.
For the CSV escaper, the fact that it is 'generic' is not a license analysis. A 12-line utility can still be copied from a copyleft project. The decision should be based on the match details and the destination repository, not on the developer's intuition.
2. Legal asks whether IP indemnity still applies if we allow matches. What conditions would you verify, and what would you tell them?
Read the worked answer
IP indemnity is contractual and conditional; do not infer it from the setting alone.
GitHub offers IP indemnity for Copilot Business and Copilot Enterprise under its agreement. It is not a blanket guarantee that any generated code is non-infringing. Publicly described conditions include using the service as intended and keeping the duplication detection guardrails in place; disabling or loosening the filter can affect eligibility. The exact scope, exclusions, notice requirements, and whether 'Allow' is permitted are in the GitHub agreement and the Customer's order form, not in a product blog.
Verify:
- The signed GitHub agreement and order form: does it incorporate the Copilot IP indemnity, and for which plans?
- The current Trust Center and Copilot documentation: what does GitHub say about the duplication filter and indemnity conditions?
- The customer's own policy: does Legal require Block as a condition of using Copilot at all?
- The open-source repositories: are they under a license that changes the analysis?
If the contract or Legal's risk appetite requires Block, do not switch globally. Escalate the specific snippet through an exception process. Telling Legal 'we turned it on but the vendor says it is fine' is not a defensible answer.
3. Propose a policy that lets developers handle the CSV escaper without turning off Block globally.
Read the worked answer
Keep Block globally; create a narrow exception path.
- Default stays Block. That preserves the preventive guardrail and avoids a fleet-wide policy change for one utility.
- Internal snippet library. Have the developer write the CSV escaper from scratch, test it, and add it to an approved internal utilities package. This solves the recurring need without public-code exposure.
- Exception process. If a specific match is genuinely needed, require: the match details (repo, URL, license), the destination repository and its license, a code owner's approval, and a Legal review for copyleft or unknown licenses. Time-box the exception and log it.
- Scope the exception. If the platform supports repository-level settings, allow matches only in the open-source repositories, not in proprietary repos. Do not use a personal account to bypass the control.
- Educate and audit. Show developers where the match indicator appears and why 'generic' is not a license conclusion. Sample accepted matches monthly.
This gives the developer a fast path for a common utility while keeping the organization's default aligned with its indemnity and compliance posture.