GitHub Copilot Traffic Analysis via MITM Proxy Exposes Prompt Context Handling and Local SQLite Session Storage
A detailed reverse-engineering study placed GitHub Copilot behind an mitmproxy instance to inspect all network requests made by Visual Studio Code. The analysis revealed that Copilot performs OAuth token exchange, model availability checks, and intent classification before any user input occurs. Prompts sent to the model include context from recently edited files, even when inline suggestions are disabled for sensitive extensions such as .env. Copilot maintains a local SQLite database named session-store.db that records every user prompt, LLM response, repository, and branch worked on. The extension also exposes a session_store_sql tool allowing the model to run read-only SQL queries against this history using the Copilot Chronicle skill. These findings highlight how AI coding assistants manage context, authentication, and persistent local state.
Habr•AI Security
