Use GitHub Copilot Responsibly
Domain 1 - Use GitHub Copilot Responsibly
This domain tests whether you treat Copilot as an accelerant for a human-owned engineering process, not an authority. Questions probe accountability, review discipline, security, licensing, and transparency in day-to-day use.
Core rules
- The developer who accepts a suggestion owns it. Accountability never transfers to the model or to GitHub.
- Treat every completion and chat answer as unreviewed third-party code: read it, test it, scan it before merge.
- Security: Copilot reproduces plausible patterns, not safe ones - string-concatenated SQL, weak crypto, hardcoded credentials, missing authorization checks. Run CodeQL, secret scanning, and dependency review on AI-assisted changes exactly as on hand-written ones.
- Licensing: the public code matching filter (duplication detection) can block or warn on suggestions that match public repositories. It reduces risk; it is not legal clearance. Organizations with IP indemnity still expect human review.
- Fairness and correctness: generated prose, identifiers, and assumptions can encode bias. Validate against your own requirements and data.
- Transparency: follow your organization's disclosure policy, and never paste regulated data into a prompt without approval.
Worked example
A candidate is asked what to do with this inline suggestion inside a login handler: the code builds a query by concatenating user input directly after WHERE email = '. The weak answer is “accept and test manually”. The reasoning the exam wants: (1) the pattern is SQL-injection-prone; (2) acceptance is a human decision, so reject it and rewrite with a parameterized query; (3) add a test and let CodeQL confirm; (4) note the suggestion came from pattern prediction, not security analysis. Detect, rewrite, verify, log - that sequence is the responsible-use answer.
Traps
- “Copilot Business or Enterprise means output is pre-vetted.” It means stronger data protections, not correctness guarantees.
- “The public code filter guarantees license safety.” It filters matches against a public index; it does not evaluate your obligations.
- Reflexive Tab-acceptance of multi-line ghost text is the classic responsibility failure.
- Assuming Copilot-generated tests validate behavior - they often assert current behavior, bugs included.