A MITM proxy capture reports GitHub Copilot querying a local SQLite session store and sending .env contents as completion context

Sources: primary, discussion
Summary: The author put GitHub Copilot behind a MITM proxy and reports a session_store_sql tool backed by a local session-store.db that holds prompts and model responses from past sessions. The post also reports a completion request that carried a value from a .env file while the author was typing in an unrelated file, with Copilot completions already disabled for .env. The evidence is one author's captures on one machine, published 2026-08-04, and GitHub has not confirmed it.
Why it matters: If the capture holds, disabling completions for a file extension does not keep that file's contents out of requests triggered elsewhere.
Follow-up: A GitHub statement, or an independent reproduction of the capture.