Finding leaked passwords with AI: How we built Copilot secret scanning

This post details the engineering effort behind Copilot secret scanning for generic passwords. It describes the challenges of using LLMs for security detection, particularly with unconventional file types, and the iterative process of improving offline evaluation frameworks and prompting strategies (including MetaReflection). The post also outlines the development of a workload-aware request management system to scale LLM capacity efficiently and the use of mirror testing to achieve a 94% reduction in false positives, demonstrating increased precision without sacrificing recall.