Can GitHub Copilot leak secrets?

Copilot can suggest code containing hardcoded API keys, passwords, and tokens that it learned from public repositories. While GitHub has filters to reduce secret exposure, Copilot may still suggest patterns like placeholder credentials that developers replace with real values but forget to move to environment variables. It can also suggest code that reads secrets from insecure locations or logs sensitive information. The broader risk is that Copilot normalizes insecure credential handling patterns. UNPWNED checks client-accessible bundles, responses, and public sensitive-file paths for supported exposed-secret patterns; private source and server configuration require separate review.