4.1.3. Proxy Filtering and Post-Processing
💡 First Principle: The GitHub proxy is an active inspection checkpoint, not a passive relay. It screens the prompt before the model sees it and screens the response before you see it — the safety and quality controls live here.
Your request travels through a GitHub-owned proxy hosted on Microsoft Azure. The proxy does real work in both directions:
Inbound (before the LLM): pre-inference checks screen the prompt for toxic or inappropriate language, relevance, and hacking/jailbreak-style attempts. Only a vetted prompt reaches the model.
Outbound (after the LLM): post-processing applies a toxicity filter to remove harmful or offensive generated content, then a final layer of quality, security, and policy checks — including, when configured, a proximity check against public GitHub code (the public-code matching filter) and real-time blocking of insecure patterns like hardcoded credentials or obvious injection. Suggestions are ranked, and only vetted ones reach your editor.
| Stage | Direction | What it does |
|---|---|---|
| Pre-inference screening | Inbound | Toxicity, relevance, jailbreak detection before the model |
| Toxicity filter | Outbound | Removes harmful/offensive generated content |
| Quality/security checks | Outbound | Vulnerability blocking, policy enforcement, ranking |
| Public-code matching | Outbound (if enabled) | Suppresses/flags suggestions matching public code |
📝 Note: A subtlety the exam may probe: at the inbound stage the proxy screens for toxic language, relevance, and jailbreaks — it does not mask your sensitive data before sending to the LLM. Protecting sensitive files is the job of content exclusions, applied earlier, not the proxy's inbound filter.
⚠️ Exam Trap: Treating the proxy as "just a network hop" misses its central role. Both the safety filtering and the public-code/security post-processing happen at the proxy — it's where much of Copilot's responsible-AI machinery lives.
Reflection Question: Name one thing the proxy does on the way in and two things it does on the way out, and explain why "passive relay" is the wrong description.
