Why this category matters Link to heading

Security work needs repeatable workflows and explicit controls. The Analyze security category shows how Copilot Chat can accelerate setup and triage while keeping humans in control of final decisions.

Use cases Link to heading

  • Engineers hardening repository defaults and dependency workflows
  • Security champions triaging vulnerability findings with developers
  • Developers who need guardrails for Copilot-assisted security workflows

The 3 examples in this category Link to heading

  1. Securing your repository
  2. Managing dependency updates
  3. Finding existing vulnerabilities in code

Diagram: Security hardening flow Link to heading

B - - - D - - - C - C - - a e o o s s p b p d u P d v s n c r e e u r e e p R e u e t o e l c s a n p d - l c i d v i r h n d e a p l n u n e i n e c e n t o e e r u e e t p h n d e l v r e o s w r c a i e a u c r s o r y b s c l b c s a a e c t u o c y i o n n p a e l h t h r l d v n d o n c e y . e t e i i a i n t s g y d u v t n l n t s i i i m u n i y g i g r e n o e l l i e d i t g n n e n w p f a a u e s g r i t g p o x i e m e o p s n t s

1) Securing your repository Link to heading

Cookbook scenario:

  • Ask for step-by-step enablement of essential repository security features.

Features called out in the example:

  • Secret scanning
  • Push protection
  • Dependabot alerts
  • Dependabot security updates
  • Branch protection rules with required reviews

Prompt pattern:

Provide step-by-step instructions to enable essential repository security features,
including why each one matters.

Additional cookbook workflow:

  • Generate a SECURITY.md policy with reporting path, response timeline, disclosure guidance, and supported versions.

2) Managing dependency updates Link to heading

Cookbook demonstrates two workflows.

Workflow A: generate baseline dependabot configuration by detecting package ecosystems.

Workflow B: customize Dependabot behavior for team workflow.

Customization examples from the cookbook:

  • Auto-assign reviewers/team.
  • Add labels for routing and governance.
  • Limit open PRs.
  • Ignore development dependencies where appropriate.

What to verify:

  • Ecosystem directories are correct.
  • Schedules and PR limits align with team capacity.
  • Labels and assignees exist in target repository.

3) Finding vulnerabilities in code Link to heading

Cookbook scenario:

  • Detect potential XSS in DOM update logic and suggest safer rendering.

Vulnerable code:

// Directly inserts user-controlled text into the DOM
function renderUserComment(commentText) {
  document.getElementById("comments").innerHTML += commentText;
}

An attacker who supplies <img src=x onerror="stealCookies()"> as commentText executes arbitrary JavaScript in every viewer’s browser.

Safer alternative:

// Treats user input as text, never as markup
function renderUserComment(commentText) {
  const p = document.createElement("p");
  p.textContent = commentText;
  document.getElementById("comments").appendChild(p);
}

Prompt pattern:

Analyze this code for potential security vulnerabilities and suggest fixes.

Cookbook guardrail (important):

  • Do not rely on Copilot Chat as a comprehensive security analysis tool.
  • Use GitHub code scanning for broader and deeper security coverage.

High-value prompt constraints for security tasks Link to heading

  • Ask for threat explanation plus fix.
  • Ask for minimally invasive patch.
  • Ask for tests or checks that verify the fix.
  • Ask for residual risk and recommended follow-up scanning.

Worked example Link to heading

Scenario Link to heading

You want to establish a baseline security posture for a new service repository.

Prompt 1 (baseline hardening) Link to heading 

Provide a step-by-step checklist to secure this repository.
Include secret scanning, push protection, branch protection, and code scanning.
For each item, explain why it matters and how to validate it.

Prompt 2 (dependency hygiene) Link to heading 

Generate a Dependabot configuration for npm and GitHub Actions with weekly updates,
labels, and reviewer assignment.

Prompt 3 (code vulnerability triage) Link to heading 

Analyze this code snippet for likely XSS, injection, or insecure output handling.
Suggest minimal patches and tests.

Validation checklist Link to heading

  • Security settings are actually enabled in repository UI.
  • Dependabot config matches real package ecosystems.
  • Proposed code fix is backed by tests and code scanning results.

Always pair these prompts with GitHub code scanning and human review before merge.

Key takeaways Link to heading

  • Security prompts can accelerate setup, but policy and validation remain human responsibilities.
  • Dependabot effectiveness depends on well-tuned configuration, not defaults alone.
  • Vulnerability prompts are useful for triage and patch ideas, not full security assurance.
  • Pair Copilot Chat with code scanning and disciplined review workflows.

References Link to heading