Why This Matters

The single biggest source of Copilot-induced bugs is accepting suggestions without reading them. The single biggest source of Copilot disappointment is rejecting good suggestions because the prompt was vague. This lesson gives you a loop that prevents both.

Concept Explained

Every Copilot suggestion deserves a deliberate read. The mental loop is: read → evaluate → accept or iterate → verify. Reading means understanding what the code does. Evaluating means judging it against your intent and conventions. Accepting means committing; iterating means refining the prompt. Verifying means running tests or checking output.

How It Works

The loop runs on every suggestion. Reading is mental, takes 2–10 seconds. Evaluating compares the suggestion to: correctness, idioms, security, performance, edge cases. Accepting = Tab. Iterating = follow-up prompt. Verifying = run tests or execute. The loop closes when the suggestion is correct and verified.

Step-by-Step Tutorial

1. Read

2. Evaluate

3. Accept or iterate

4. Verify

5. Document

Real-World Example

A developer accepted a Copilot suggestion for a JWT validation function without reading it carefully. The function looked correct but accepted tokens with `alg: none` — a known JWT vulnerability. Two weeks later a security audit caught it. The fix was a one-line change, but the trust cost was higher. A 30-second read would have caught the issue.

Example Prompts / Commands / Code

# Initial prompt:
function authenticate(token) { ... }

# Copilot suggests:
function authenticate(token) {
  const decoded = jwt.decode(token);
  return decoded.user;
}

# Iterate (reject, then):
Add signature verification. Reject alg=none. Throw on invalid token.

# Better suggestion:
function authenticate(token) {
  const decoded = jwt.verify(token, SECRET, { algorithms: ['HS256'] });
  if (!decoded.user) throw new Error('Invalid token');
  return decoded.user;
}

Common Mistakes

• Tab-Tab-Tab — accepting without reading.
• Rejecting good suggestions because the prompt was vague.
• Iterating endlessly — sometimes the model just can't help; write it yourself.
• Accepting without verifying — tests catch what your eyes miss.

Best Practices

• Read every suggestion; don't skim.
• Define a personal rule: accept if correct, idiomatic, secure, and matches conventions.
• Iterate via follow-up prompts rather than starting over.
• Verify every acceptance with tests or execution.
• For non-trivial code, document why you accepted for code review.

Troubleshooting

Practical Exercise

Frequently Asked Questions

Further Reading

• Responsible use of Copilot

Official References

• Responsible use of Copilot

Related lessons: BE-07, BE-15, BE-31