Undocumented `logs/security/.security-key` file created in every working directory on startup

Description

Copilot CLI creates a logs/security/.security-key file in the current working directory as soon as a session starts. This happens in every directory, including a brand-new empty one, so it appears to be unconditional CLI startup behavior rather than something tied to a specific repo or project config.

I can't find this documented anywhere - not in the CLI config-directory reference, the command reference, or recent changelogs (checked back through v1.0.76). Filing this to understand what the file is for and whether it's expected to live in the project directory rather than ~/.copilot/.

Steps to reproduce

mkdir /tmp/test-copilot && cd /tmp/test-copilot && copilot
# exit the session
ls -la logs/security/

Observed

harshit@Harshits-MacBook-Pro /tmp/test-copilot » ls -la logs/security
total 8
drwxr-xr-x@ 3 harshit  wheel  96 Jul 31 10:52 .
drwxr-xr-x@ 3 harshit  wheel  96 Jul 31 10:52 ..
-rw-------@ 1 harshit  wheel  32 Jul 31 10:52 .security-key

The file contains 32 bytes of what appears to be binary/random data (confirmed via xxd), not human-readable text.

Questions

1. What is this file used for (e.g., local encryption of session state, sandbox integrity verification, telemetry)?
2. Is it intentional that it's written under <cwd>/logs/security/ rather than under ~/.copilot/? This means every project directory a user runs copilot in accumulates this file, which could easily get committed to version control if not gitignored.
3. Should this path be added to a default .gitignore suggestion, or documented in the config-directory reference alongside the other ~/.copilot/ contents?

Environment

• Copilot CLI version: GitHub Copilot CLI 1.0.77
• OS: macOS 26.4 (25E246)
• Install method: I don't remember, I have been using copilot for a while now. The only change that happened is I recently updated the version.

Führe die bereitgestellte mkdir-, cd-, copilot- und ls-Reproduktion in einem leeren Verzeichnis aus und verfolge anschließend den CLI-Startpfad, der logs/security/.security-key erstellt. Lies die im Bericht erwähnte Referenz zum CLI-Konfigurationsverzeichnis, die Befehlsreferenz und die Changelogs. Als abgeschlossen gilt die Aufgabe, wenn der Zweck und der vorgesehene Speicherort der Datei geklärt sind und das Verhalten zusammen mit allen gitignore-Hinweisen korrigiert oder dokumentiert wurde.