No one uses API keys with Copilot intentionally. If you install the VSCode extension and start using it, and you happen to open a file that has an API key in it, boom - it's sent to Copilot. That is the issue. It's currently like walking a tightrope with no guardrails, and it's not obvious.