CheatSheetSeries
AGENTS.md34k starsChanged 29 days agoCC-BY-SA-4.0View on GitHub
This file governs every AI tool used in this repository — Claude Code, Codex, Cursor, Copilot, and anything else. If you are an AI assistant generating issues, pull requests, comments,…
We split this AGENTS.md into the rules it gives an agent
10 rules. About 0 are common, 9 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈9
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
Licensed with conditions — read it at the source. We count its rules but don't quote them. Read them on GitHub.
≈ “Common” is an estimate: at least 1 in 5 of the 36,368 AGENTS.md files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Trending
More talk lately.about the whole repository
Who's talking about OWASP/CheatSheetSeries
- Michel Kartner“Créez votre IA Pentest 100% locale et sans censure (LM Studio + AnythingLLM)”YouTube · Jun 1, 2026 · 60k views
- Inside Cloud and Security“CCSP Exam Cram - DOMAIN 2 (2023)”YouTube · Feb 24, 2023 · 43k views
- Inside Cloud and Security“CCSP Exam Cram - DOMAIN 3 (2023)”YouTube · Mar 15, 2023 · 33k views
- Inside Cloud and Security“CCSP Exam Cram - DOMAIN 4 (2023)”YouTube · Mar 25, 2023 · 28k views
- Override“XXE Injection - Explained”YouTube · Apr 23, 2019 · 16k views
The biggest 5 of 65 mentions linking to the repository that our crawl found. Each line is their own headline.
See all 65
Talked about on GitHub, Stack Overflow, YouTube, Hacker News and the web (65 times).
On GitHub · 25
- Jun 12, 2019Sensitive information are being persisted in local storage — aws-amplify/amplify-js116 reactions · 70 comments
- Nov 24, 2025Implement Modern CSRF Protection — django/new-features59 reactions · 12 comments
- Aug 14, 2019[Security][CSRF] Added CSRF CookieStorageInterface — symfony/symfony16 reactions · 15 comments
- May 23, 2019Argon2 Support — bcgit/bc-csharp9 reactions · 2 comments
- Mar 25, 2021Stop telling people not to install security updates — docker/docs8 reactions · 2 comments
20 more on GitHub
- Apr 9, 2020X-XSS-Protection: header should be disabled by default — helmetjs/helmet8 reactions · 17 comments
- Aug 4, 20248.2.2 advice on sessionStorage breaks multi-tab web application use unlike cookies — OWASP/ASVS3 reactions · 40 comments
- Apr 13, 2021XSS protection should be set to 0 by default per updated OWASP recommendation — spring-projects/spring-security3 reactions · 3 comments
- Dec 12, 2018Weak password policy — PrestaShop/PrestaShop3 reactions · 3 comments
- Jul 7, 2025Initial JWT cookie Authentication — INTERSECT-SDK/registry-service2 reactions · 3 comments
- Mar 6, 2020Merge REST Assessment CS into WSTG — OWASP/wstg2 reactions · 16 comments
- May 21, 2019Should mention CORS — shieldfy/API-Security-Checklist2 reactions · 1 comment
- Apr 22, 2019Open Redirect in /authorize inside sample server — go-oauth2/oauth22 reactions · 2 comments
- Sep 10, 2026docs: fix dead link for csrf — envoyproxy/gateway1 reaction · 1 comment
- Jul 30, 2026Policy for AI contributions — OWASP/OCSD1 reaction
- Dec 10, 2019Test TLS server configuration — microsoft/CCF1 reaction · 2 comments
- May 13, 2019【面试篇】寒冬求职之你必须要懂的Web安全 — YvetteLau/Blog1 reaction
- Apr 22, 2019Client Secret, Refresh Token, Access Token are stored in plaintext — go-oauth2/oauth21 reaction · 3 comments
- Jun 14, 2025Plan de sécurisation — DiscoMajor/re-sources-relationnelles0 reactions
- Nov 9, 2021Security Cheat Sheet — ethinallen/ethinallen0 reactions
- Oct 26, 2021Secure the API — caizixian/goxidize0 reactions
- Feb 28, 2020Email & password reset — FoalTS/foal0 reactions · 2 comments
- Nov 6, 2019Add server-side validation for organization class — crchong1/senior_design_20190 reactions
- Apr 20, 2019Sanitize file upload form & input — bbenefield89/LegendsViewerBrowser-Client0 reactions
- Mar 8, 2019Add security section — messa/what-next0 reactions
On Stack Overflow · 21
- Mar 27, 2017Vuex store empty if i refresh my webpage16 votes
- Jan 21, 2020Options for token storage and refresh in SPAs7 votes · 1 answer
- Dec 22, 2019Why is auth0 recommending not to store tokens in localStorage?7 votes · 1 answer
- Apr 29, 2013Does HTML encoding prevent XSS security exploits?6 votes
- Mar 18, 2022How do I pass the JWT from the server to the client in a an http-header3 votes
16 more on Stack Overflow
- Jun 25, 2019Cookie is not set when secure option is enabled in rails session_store configuration?3 votes
- Mar 27, 2019Do I have to set XMLResolver to null for preventing XXE attacks?3 votes · 1 answer
- Nov 4, 2020Veracode XML External Entity Reference (XXE)2 votes
- Nov 14, 2019long-lived access token vs short-lived access token & refresh token pair2 votes
- Apr 25, 2019OWASP | ZAP | SQL Injection | Scan Report2 votes
- Aug 16, 2017How to secure a restful webapi core2 votes
- Feb 9, 2024Where does keycloak-js adapter store the refresh token and access token?1 vote
- Feb 9, 2024Keycloak redirects to login on page refresh1 vote
- May 18, 2023Create anchor link from location.pathname and sanitise data1 vote
- Jul 3, 2019Vulnerable when user clicks on a malicious link1 vote
- May 16, 2019How to add not valid pattern to Hibernate Validator?1 vote
- Apr 9, 2019OAuth with custom JWT authentication1 vote
- Aug 21, 2020Veracode Scan: jQuery html method showing Improper Neutralization of Script-Related HTML Tags in a Web Page issue0 votes
- Aug 17, 2019In EF of oracle, data type conversion occurs when SQL is generated by linq, which makes SQL more complex and less efficient0 votes
- May 23, 2019Checkmarx fix for CGI_Stored_XSS Vulnerability0 votes
- Mar 26, 2019How and where domain name is detected and resolved after SSL Pinning0 votes
On YouTube · 16
- Jun 1, 2026Créez votre IA Pentest 100% locale et sans censure (LM Studio + AnythingLLM) — Michel Kartnersays it tested it60k views · 84 comments
- Feb 24, 2023CCSP Exam Cram - DOMAIN 2 (2023) — Inside Cloud and Security43k views · 87 comments
- Mar 15, 2023CCSP Exam Cram - DOMAIN 3 (2023) — Inside Cloud and Security33k views · 42 comments
- Mar 25, 2023CCSP Exam Cram - DOMAIN 4 (2023) — Inside Cloud and Security28k views · 37 comments
- Apr 23, 2019XXE Injection - Explained — Override16k views · 7 comments
11 more on YouTube
- Mar 23, 2020Authentication in Node.js - #9 Session Timeout — Code Realm15k views · 38 comments
- May 16, 2019bWAPP - Cross-Site-Scripting - Reflected (JSON) - #2 — Anshuman Pattnaik11k views · 15 comments
- May 18, 2019bWAPP - Cross-Site-Scripting - Reflected (AJAX/JSON) - #3 — Anshuman Pattnaik7k views · 5 comments
- Mar 22, 2019Secure Coding: Hacking-Praxis - XSS-Angriffstechnik - So hackt man mit Cross-Site-Scripting — Bernhard Hirschmann3.4k views · 21 comments
- Nov 6, 2020OWASP Spotlight - Project 4 - Cheat Sheet Series — Vandana Verma1.3k views · 1 comment
- Aug 27, 2023How Mass Assignment Gives You Admin Privileges? | APIs | Code Examples | — Medusa1.3k views · 13 comments
- May 15, 2019XML External Entities (XXE) — Elyes Doudech151 views
- Sep 9, 2026같은 비밀번호 재사용이 위험한 진짜 이유 — 매일 한가지108 views · 1 comment
- May 15, 2019OWASP - A1 Injection — Wizka75 views
- Oct 7, 2026Introducing the OWASP Cheat Sheet Series — Dann Paker AI71 views
- Mar 19, 2019Época 01 S01E26 - Ubucons e mais Ubucons — Podcast Ubuntu Portugal11 views
On Hacker News · 2
- Oct 4, 2020CheatSheetSeries/Dotnet_security_cheat_sheet.md2 points
- Apr 23, 2019OWASP Cheatsheet Series V.22 points
On the web · 1
- Oct 29, 2026Welcome to the OWASP Cheat Sheet Series - Kitploit — kitploit.com
Where files are headingNew AGENTS.md files have more rules about keeping secrets out of the code, and fewer about code style.
Of the AGENTS.md files we read, the 28,693 first seen in the last six months, against the older ones: the kind of rule that gained most share, and the kind that lost most. About files like this in general, not this one, and an estimate, since a kind is a pattern in the words.
In this repository2 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- code-reviewSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
Reviews can't be read right now.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

