Copilot Reads a Gitignored File in VS Code: Why It Happens and What to Check

If Copilot refers to a file in .gitignore, it does not necessarily mean the workspace index ignored your rule. VS Code excludes gitignored files from its normal semantic index and search, but opening or selecting content in an ignored file can bring it into context. Previous chat messages, pasted text and tool output can also contain the same information.

Do not test with real secrets. Use a harmless marker in a disposable file. If a genuine credential was exposed, rotate or revoke it through your incident process; hiding the file afterward cannot recall a previous request.

Understand the Different Ways a File Reaches Copilot

The current VS Code workspace-context documentation says .gitignore excludes files from text search, grep and the semantic index. files.exclude also affects Explorer visibility, search and the index; search.exclude affects text search/grep while keeping files visible.

Those are discovery controls, not an operating-system permission boundary. The documentation specifically notes that an open or selected ignored file bypasses the normal ignore behavior. An attached file or terminal result is another source of context. An agent may also have tools that read files independently of the index.

Conversation history matters too. A rule added today does not erase text already pasted into a chat or returned by a tool. The context guide distinguishes active editor context, explicit references, history and tool results.

Run a Safe, Focused Diagnostic

1. Create a test file containing an invented marker, with no production credentials or private data. Add its path to the relevant .gitignore or workspace exclusion rule.
2. Close that file and remove any explicit attachment or text selection. Start a new chat so prior discussion of the marker cannot affect the result.
3. Ask a narrow codebase question and inspect the search/file-read actions and listed references. Do not assume that a generated phrase alone proves which source was read.
4. Compare with an allowed test file. If both are absent, first check whether the query and workspace are correct.
5. If the semantic index itself appears stale, use the documented Build Codebase semantic index command. Rebuilding an index does not delete old chats or revoke previously granted access.

For generated content you still want visible in Explorer, an illustrative workspace setting is:

"search.exclude": {
  "**/generated/**": true,
  "**/build/**": true
}

Merge settings into the existing JSON object. This reduces noisy searches; it does not prohibit opening those files. Check the active workspace, nested folders and exact matching path rather than copying an arbitrary absolute pattern.

Do not use github.copilot.ignoredFiles or a supposed GitHub Copilot: Clear Index command as a repair. These are not the current documented controls. A copilot-instructions.md request to avoid a folder can express intent, but cannot enforce file permissions.

Use Stronger Controls When Confidentiality Is the Requirement

Eligible Business/Enterprise organizations can use Settings → Copilot → Content exclusion with administrator-managed path rules for supported features. Follow the configuration and test procedure; it is separate from .gitignore.

Check the current scope and limitations. In particular, GitHub documents that exclusions are not supported in IDE Edit and Agent modes, and lists limitations involving symlinks, remote filesystems and indirect semantic information. Do not treat an inline-suggestion exclusion test as protection for every agent tool.

For material that must not reach a cloud service, use an approved environment where that material is not accessible to the agent, with appropriate tool, filesystem and network restrictions. Keep live credentials out of working source wherever possible. If the needed restriction cannot be verified, stop using the affected AI feature on that data and ask the administrator to validate the boundary.

Official documentation checked: October 14, 2026.