Preventing Open Security Groups: VS Code Copilot and Terraform

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target. The local audit log records decisions on a best-effort basis: entries can be dropped if the daemon queue is full, and old rows are deleted at the row caps. It is local, not append-only, and not immutable.

Describe the task

VS Code Copilot is cleaning up the .gitignore file to remove stale entries. In the process, it removes the .env exclusion:

# Before
.env
*.log
dist/

# After — .env removed
*.log
dist/

SSG blocks the write — without .env in .gitignore, the next git add will stage the secrets file.

# illustrative sample output
[BLOCK] write › .gitignore — rule: protect-env-in-gitignore

Give SSG context

SSG evaluates VS Code Copilot's file write calls via the SSG MCP Server integration.

Required context

rule protect-env-in-gitignore {
  enabled true
  priority 100
  severity error
  DENY write
  IF path ENDS_WITH ".gitignore"
  AND NOT content CONTAINS ".env"
  MESSAGE ".gitignore must include .env. Removing this entry will expose secrets on the next commit."
}

Optional context

Require additional sensitive file patterns:

rule protect-secrets-in-gitignore {
  enabled true
  priority 95
  severity error
  DENY write
  IF path ENDS_WITH ".gitignore"
  AND NOT content CONTAINS ".env"
  AND NOT content CONTAINS "*.pem"
  AND NOT content CONTAINS "*.key"
  MESSAGE ".gitignore is missing critical secret file patterns (.env, *.pem, *.key)."
}

What SSG does

SSG checks the .gitignore content at write time. The .env protection is never removed — secrets remain excluded from version control.

Ask the agent to preserve the .env entry

.gitignore modification was blocked: .env entry was removed.
Keep the following entries in .gitignore at all times:
  .env
  .env.local
  .env.*.local
  *.pem
  *.key
  secrets/
If you need to clean up .gitignore, only remove entries for patterns that no longer exist in the project.

Use git-secrets for defense in depth

Add git-secrets as a pre-commit hook to catch any secrets that slip through:

git secrets --install
git secrets --register-aws  # also registers common API key patterns

This adds a second layer of protection at the git commit layer, complementing SSG's write-time checks.

Audit .gitignore changes

SSG logs modifications to .gitignore, allowed or blocked, on a best-effort basis. Use ssg dashboard to review all gitignore changes and ensure critical exclusions are always present.