Top 5 Vulnerability Patterns in GitHub Copilot Code

The Pattern

// ❌ Copilot loves this pattern
const getUser = async (userId) => {
  const query = `SELECT * FROM users WHERE id = '${userId}'`;
  return await db.query(query);
};

// Also suggests:
const searchProducts = async (term) => {
  return await db.query(
    `SELECT * FROM products WHERE name LIKE '%${term}%'`
  );
};

// And in updates:
const updateEmail = async (userId, email) => {
  await db.query(
    `UPDATE users SET email = '${email}' WHERE id = ${userId}`
  );
};

Why This Happens

Copilot learned from millions of tutorials and Stack Overflow answers—many showing quick examples without security considerations. Template literals are visually cleaner, so they appear more often in training data.

The Fix

// ✅ Always use parameterized queries
const getUser = async (userId) => {
  return await db.query(
    'SELECT * FROM users WHERE id = ?',
    [userId]
  );
};

// With named parameters:
const searchProducts = async (term) => {
  return await db.query(
    'SELECT * FROM products WHERE name LIKE :term',
    { term: `%${term}%` }
  );
};

The Pattern

// ❌ Copilot suggests real-looking keys
const stripe = new Stripe('sk_live_4eC39HqLyjWDarjtT1zdp7dc');

const openai = new OpenAI({
  apiKey: 'sk-proj-1234567890abcdef1234567890abcdef'
});

// Even worse - in client-side code:
const firebaseConfig = {
  apiKey: "AIzaSyDOCAbC123dEf456GhI789jKl012-MnO",
  authDomain: "myapp-12345.firebaseapp.com",
  projectId: "myapp-12345"
};

// Database credentials:
const db = mysql.createConnection({
  host: 'localhost',
  user: 'root',
  password: 'admin123',  // Copilot loves common passwords
  database: 'production'
});

Why This Happens

Training data includes countless examples with dummy keys. Copilot can't distinguish between example and production code. It often generates realistic-looking keys that could be mistaken for test credentials.

The Fix

// ✅ Always use environment variables
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);

const openai = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY
});

// Validate at startup:
if (!process.env.STRIPE_SECRET_KEY) {
  throw new Error('Missing required: STRIPE_SECRET_KEY');
}

// For client-side, use server endpoints:
// Never expose keys to frontend

The Pattern

// ❌ Mixed authentication = security bypass
app.get('/api/user/:id', async (req, res) => {
  // Copilot suggests checking multiple auth methods
  if (req.headers.authorization || 
      req.session?.userId || 
      req.query.apiKey) {
    // ANY of these passes = authenticated!
    const user = await getUser(req.params.id);
    res.json(user);
  }
});

// Inconsistent middleware:
app.use('/api/public', noAuth);
app.use('/api/private', requireAuth);
app.use('/api/admin', sometimes);  // Copilot gets confused

// Broken role checks:
const isAdmin = (user) => {
  return user.role === 'admin' || 
         user.isAdmin || 
         user.permissions?.includes('admin');
  // Which one is canonical?
};

Why This Happens

Copilot trained on codebases using different auth strategies. When autocompleting, it mixes patterns from JWT-based apps, session-based apps, and API key systems.

The Fix

// ✅ Single authentication method
const authenticate = async (req, res, next) => {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) {
    return res.status(401).json({ error: 'No token' });
  }
  
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = await getUser(decoded.userId);
    next();
  } catch (err) {
    return res.status(401).json({ error: 'Invalid token' });
  }
};

// Consistent middleware application:
app.use('/api/private', authenticate);
app.use('/api/admin', [authenticate, requireAdmin]);

The Pattern

// ❌ Weak crypto patterns from Copilot

// MD5 for passwords (broken since 2004)
const hashPassword = (password) => {
  return crypto.createHash('md5').update(password).digest('hex');
};

// Predictable randomness
const generateToken = () => {
  return Math.random().toString(36).substring(2);
};

// ECB mode encryption (insecure)
const encrypt = (text) => {
  const cipher = crypto.createCipher('aes-256-ecb', 'password');
  return cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
};

// Reused IVs
const iv = Buffer.from('1234567890123456');  // Static IV!

Why This Happens

Old Stack Overflow answers and tutorials still use MD5. Copilot doesn't know these are from 2010 and shouldn't be used. It suggests the most common patterns, not the most secure.

The Fix

// ✅ Modern, secure cryptography

// Bcrypt for passwords
const hashPassword = async (password) => {
  return await bcrypt.hash(password, 12);
};

// Crypto-secure randomness
const generateToken = () => {
  return crypto.randomBytes(32).toString('hex');
};

// Proper AES-GCM encryption
const encrypt = (text, key) => {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  
  const encrypted = Buffer.concat([
    cipher.update(text, 'utf8'),
    cipher.final()
  ]);
  
  const authTag = cipher.getAuthTag();
  return { iv, authTag, encrypted };
};

The Pattern

// ❌ Direct path concatenation
app.get('/download/:filename', (req, res) => {
  const file = `./uploads/${req.params.filename}`;
  res.sendFile(file);
});

// Dangerous file operations
app.post('/upload', async (req, res) => {
  const filename = req.body.filename;
  const content = req.body.content;
  
  // No validation!
  await fs.writeFile(`./data/${filename}`, content);
});

// Template rendering
app.get('/page/:name', (req, res) => {
  // Path traversal to any file
  res.render(`pages/${req.params.name}`);
});

Attack Examples

// Access password file:
GET /download/../../../../../../etc/passwd

// Overwrite server code:
POST /upload
filename=../app.js

// Read source code:
GET /page/../../config/database

The Fix

// ✅ Validate and sanitize all paths
const path = require('path');

app.get('/download/:filename', (req, res) => {
  // Only basename, no directory traversal
  const filename = path.basename(req.params.filename);
  const safePath = path.join('./uploads', filename);
  
  // Ensure it's within uploads directory
  if (!safePath.startsWith(path.resolve('./uploads'))) {
    return res.status(400).json({ error: 'Invalid path' });
  }
  
  res.sendFile(safePath);
});

// Whitelist allowed files
const ALLOWED_PAGES = ['home', 'about', 'contact'];
app.get('/page/:name', (req, res) => {
  if (!ALLOWED_PAGES.includes(req.params.name)) {
    return res.status(404).send('Not found');
  }
  res.render(`pages/${req.params.name}`);
});