Does Copilot generate secure API routes?

Copilot frequently generates API routes that lack proper security controls. Common issues include missing authentication middleware, no input validation or sanitization, missing rate limiting, overly permissive CORS configurations, and verbose error responses that leak implementation details. Copilot tends to generate the simplest functional implementation, which means API routes often accept any input and return full database objects without filtering sensitive fields. UNPWNED tests your API endpoints for authentication, rate limiting, CORS policy, and information disclosure to catch issues that Copilot introduced.