How to use GitHub Copilot safely?

Treat every Copilot suggestion as untrusted input that requires security review. Enable GitHub Advanced Security and Copilot code scanning to catch common issues. Never accept suggestions that handle authentication, authorization, cryptography, or database queries without careful review. Use Copilot for boilerplate and UI code where security impact is lower, and write security-critical code manually. Set up pre-commit hooks that scan for secrets and common vulnerability patterns. Run automated security testing on every pull request. UNPWNED adds a bounded outside-in deployment assessment for signals such as security-header gaps, public exposure, dependencies, endpoints, CORS, rate limits, and error disclosure. It does not replace code-level review.