Can GitHub Copilot leak secrets?

Copilot can suggest code containing hardcoded API keys, passwords, and tokens that it learned from public repositories. While GitHub has filters to reduce secret exposure, Copilot may still suggest patterns like placeholder credentials that developers replace with real values but forget to move to environment variables. It can also suggest code that reads secrets from insecure locations or logs sensitive information. The broader risk is that Copilot normalizes insecure credential handling patterns. UNPWNED scans your deployed application for exposed secrets, API keys, and credentials in client-side code, configuration files, and API responses.