🔐 Building a Secure Copilot Development Environment

GitHub Dev Days 2026 — 30-minute session

This repository contains a comprehensive Marp presentation on implementing defence-in-depth security controls for AI-assisted development environments.

Overview

Learn how to build a secure, production-ready development environment for Copilot-assisted development by implementing five layers of security controls:

1. Layer 1: Pre-commit hooks — Secret detection (detect-secrets + gitleaks), code formatting, dependency scanning
2. Layer 2: Devcontainer hardening — Docker-in-Docker isolation, Linux capability restrictions, security options
3. Layer 3: Static analysis — Build-time Roslyn analyzers, CodeQL SAST, GitHub Code Security quality gates
4. Layer 4: CI/CD supply chain security — Trivy vulnerability scanning, SBOM generation, container image signing
5. Layer 5: AI configuration — .github/copilot-instructions.md constraints, MCP servers, anti-hallucination guards, client data handling

Quick Start

View the presentation

Online: https://greven145.github.io/github-devdays-presentation/

Local (requires Marp CLI):

npm install -g @marp-team/marp-cli
marp slides/presentation.md --server

Then open http://localhost:8080 in your browser.

Build locally

# HTML version
marp slides/presentation.md --html --output presentation.html

# PDF version
marp slides/presentation.md --pdf --output presentation.pdf

Presentation Structure

• 37 slides with full speaker notes
• ~30 minutes of content (adjust pacing to your audience)
• GitHub-branded theme (Primer colour palette)
• Reference to working sample repo (Greven145/secure-copilot-devenv)

Key sections:

1. Problem statement — Why AI without guardrails is risky
2. Five layers of defence — Deep dives into each control layer
3. Architecture overview — Visual defense-in-depth model
4. What we learned — Four key lessons from production experience
5. Demo walkthrough — The sample repo scaffolding
6. Quick-start checklist — Your first 30 minutes
7. Takeaways — Key insights and resources

The Sample Repo

This presentation references Greven145/secure-copilot-devenv — a complete reference implementation.

What's included:

• Security-hardened .devcontainer/ (DinD, cap-drop, pinned versions)
• Complete .pre-commit-config.yaml (gitleaks, zizmor, actionlint, detect-secrets)
• .github/copilot-instructions.md with AI constraints and anti-hallucination guards
• Minimal .NET 10 MCP server with comprehensive tests
• Full CI/CD workflows (build, CodeQL, Trivy, DAST)
• GitHub Actions security linting

The sample repo is not a tutorial. It's a production-ready scaffold. Fork it. Adapt it to your stack. Go.

Speaker Notes

Each slide includes detailed speaker notes (visible in presenter mode). Notes include:

• Context and rationale for each decision
• Real production incidents that motivated the controls
• Trade-offs and trade-offs considered
• Example code snippets and commands
• Recommendations and next steps

To view speaker notes:

• In browser: Open in presenter mode (press P in Marp server)
• In PDF: Notes are included in the PDF (see notes pages)
• In Markdown: Look for <!-- comment --> sections

Customization

The presentation is built in Marp, a markdown-based slideshow framework. You can:

1. Edit slides: Modify slides/presentation.md
2. Change theme: Update slides/theme.css (currently uses GitHub Primer palette)
3. Add diagrams: Include Mermaid diagrams or images in slides/

Prerequisites

• Node.js 20+ (for Marp CLI)
• Git (to clone the sample repo)
• Docker (optional, to build the sample devcontainer)

License

This presentation and sample code are provided as-is for educational and internal use.

Resources

• Pre-commit framework: https://pre-commit.com
• gitleaks: https://github.com/zricethezav/gitleaks
• detect-secrets: https://github.com/Yelp/detect-secrets
• Trivy: https://github.com/aquasecurity/trivy
• CodeQL: https://codeql.github.com
• Marp: https://marp.app
• ModelContextProtocol: https://modelcontextprotocol.io

Questions?

Open an issue or reach out after the session.

---

🔐 Build secure. Ship fast.