Shell integration sends all your commands to Copilot without approval
This shocked me a bit to find out. The AI in my Copilot chat said that I had incidentally leaked a password on the chat. And I was like: "no way jose, I ran PASSWORD=foobar my-test.pl in the terminal and only pasted the result in the chat".
It insisted, and I started testing. It turns out that if you enable the Shell integration, terminal.integrated.shellIntegration.enabled, VS Code will pick up the commands you run (fine, I guess, that's kind of the point), and then it will silently send it to Copilot as a context metadata, without telling you, asking for your permission, or providing a way to not do this. (NOT FINE)
I highly recommend to turn off this setting, or possibly use an external terminal program for anything you don't want the AI chat to send to the cloud.
And, oh, if you keep it on, you do not need to repeat to the chat what you ran and if it worked -- it already knows... :-/