What I Learned by Putting GitHub Copilot Behind a MitM Proxy

Curious about how AI-powered desktop apps work under the hood, I set up a man-in-the-middle proxy to intercept VS Code and Copilot's network traffic. I discovered that Copilot sends a surprising amount of data before you even type a keystroke, including OAuth tokens, model discovery, and even your prompts and responses stored in a local SQLite database. I also found that disabling Copilot for secret files like .env doesn't stop it from sending context from other files you're editing.