Is GitHub Copilot generated code secure?

GitHub Copilot generates code that frequently contains security vulnerabilities. Stanford research found that roughly 40% of Copilot code suggestions contain exploitable weaknesses including SQL injection, cross-site scripting, and insecure cryptographic practices. Copilot learns from public repositories that include both secure and insecure patterns, and it lacks the ability to distinguish between them. The AI optimizes for functional correctness and code completion speed, not security. Every Copilot suggestion should be reviewed for security implications before accepting it into your codebase. UNPWNED checks externally observable exposure, configuration, dependency, endpoint, form, CORS, rate-limit, and error-disclosure signals. Cryptographic code requires direct review. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.