LOCKE FOR GITHUB COPILOT
Let Copilot read your code without reading your secrets.
GitHub Copilot works by sending context: the file you're in, nearby open files, and surrounding code, so its suggestions fit your project. That context model is precisely what makes it powerful and precisely where the exposure lives. The repository that contains your business logic also contains .env files, hardcoded API keys, connection strings, test fixtures stuffed with real customer records, and comments that quote production incidents.
Unlike a chat tool where a person decides what to paste, Copilot gathers context automatically. A developer rarely thinks "I am now transmitting this secret" — they just keep typing while the assistant quietly pulls in whatever is open. Secret-scanning catches credentials after they've been committed; the leak to the AI happens earlier, at suggestion time.
Locke addresses the earlier moment. It detects credentials and sensitive data in the context being assembled and masks them before they're sent upstream, so you get Copilot's completions without feeding it the parts of your repo that were never meant to leave your laptop.
The risk with GitHub Copilot
Copilot automatically pulls your open files into its context to generate suggestions — including files that hold API keys, connection strings, and customer data — so secrets can leave the machine without the developer ever making a deliberate choice to share them.
How Locke helps
Locke detects secrets and sensitive data in the context being assembled and masks them before transmission. Locke — the Sonomos desktop app, coming soon — covers Copilot inside your IDE alongside every other AI tool, since the leak happens at the editor, not the browser.
Keep using GitHub Copilot — without the exposure
Locke runs entirely on your device. Sensitive data is detected and masked before any prompt is sent, so nothing confidential ever leaves your machine. Pricing for Locke, the desktop app, is coming soon; Canary is free and open source.
