The correct practice is Limit use to vetted IDEs that are approved by your security team.

Copilot is delivered through editor extensions and controlling the environment is an effective way to manage risk. By using vetted IDEs your organization can standardize which extensions and versions are allowed, apply organizational Copilot policies, and rely on audit logs to monitor usage. Restricting access to vetted IDEs limits where source code can be processed which reduces the chance of accidental exposure and it makes compliance reviews and incident response more predictable.

Allow Copilot suggestions in every repository including public and private repos increases the chance of unintentional disclosure and weakens governance. Broad enablement across public repositories does not align with least privilege and does not help enforce compliance boundaries.

Use VPC Service Controls to restrict Copilot traffic and enforce data boundaries is not applicable because VPC Service Controls is a Google Cloud feature that protects access to Google APIs. It does not control traffic to or from GitHub Copilot which is a separate SaaS service.

Turn off audit logging and snippet collection to reduce data retention undermines compliance and monitoring objectives. Disabling logs removes visibility that security teams need and Copilot provides administrative controls and documented privacy practices that should be configured rather than turning off observability.

Full AWS Practitioner Certification Question