Copilot Confessions: Is Your Private Repository Actually Public?

No ratings

Presented at BlueHat IL 2025 by

Bar Lanyado

Ophir Dror

Imagine asking Copilot a question about your organization and unexpectedly receiving code from a private repository. At first, you probably think its an hallucination and dismiss it. Then you recognize your actual code. You go on to Github to make sure everything is indeed private and you find out it is. But is it really? In this session, we'll uncover a critical vulnerability in Bing's caching mechanism that allows unauthorized users to access GitHub repository data, even if became private. This vulnerability is exploitable by Bing & amplified by Copilot. With a few questions- you could get access to private repositories, full-codebases, notebooks and dependencies. By thoroughly analyzing the exposed repositories, we uncovered sensitive code, access tokens, configuration files and more. Our journey began when we encountered a post claiming, ""ChatGPT has access to private repository data."" While debunking that claim, we made a shocking discovery: our own sensitive data was exposed & Bing had indexed it. When we queried Copilot, it unexpectedly revealed details from our private project. We will walk you through our methodology of identifying affected repositories at scale, the process of collecting and analyzing every repo in the world that transitioned from public to private, and the real-world impact this vulnerability has, including case studies from actual companies that were affected. Our presentation will cover the motivation behind our research, the technical details of the vulnerability, potential risks for organizations and individuals, and best practices for mitigating exposure. Attendees will gain valuable insights into the persistence of data in search engine caches, the importance of proactive security measures in cloud-based version control systems, techniques for large-scale security audits of public repositories, and the broader implications for data privacy and security in the age of Large Language Models (LLMs).