AGENTS.md examples from real projects

BlockReads credentialsAGENTS.md

sprout

block/sprout/AGENTS.md

names the concrete defect and the fix. - Recommend blocking only for concrete correctness, security, or agreed-contract defects with a realistic failure scenario: state the defect, how it fails

alan2207AGENTS.md

bulletproof-react

alan2207/bulletproof-react/AGENTS.md

HTTP requests with MSW instead of mocking fetch - Focus on user interactions and outcomes ## Security Considerations ### Authentication - **JWT tokens** stored in HttpOnly cookies (preferred) or localStorage - **React Query Auth

No other project uses it yet

rustfsAGENTS.md

rustfs

rustfs/rustfs/AGENTS.md

small local edit does not need a formal plan or new document. - Preserve correctness, security, durability, compatibility, and user-owned work. Within those boundaries, choose the reasoning process, algorithm

jdxReads credentialsAGENTS.md

mise

jdx/mise/AGENTS.md

perf:` - Performance improvements - `test:` - Testing changes - `chore:` - Maintenance tasks, releases, dependency updates, CI/infrastructure changes - `security:` - Security-related changes - `registry:` - Any changes to `registry/` (do not add a scope

sahatReads credentialsAGENTS.md

hackathon-starter

sahat/hackathon-starter/AGENTS.md

test/TESTING.md](test/TESTING.md) for the full picture. Short version: `test/*.test.js` are **core** tests (auth, security, session) and must always pass — they're what protects you from breaking the framework while

nettyAGENTS.md

netty

netty/netty/AGENTS.md

github/workflows/autoport-*.yml`). When a cherry-pick conflicts, the port must be done manually. ## Security Netty parses untrusted network input (HTTP/1.x, HTTP/2, HTTP/3, and more), implements TLS on top of BoringSSL/OpenSSL

backstageAGENTS.md

backstage

backstage/backstage/AGENTS.md

code style. - `/REVIEWING.md`: guidelines for pull requests and writing changesets. - `/SECURITY.md`: guidelines for security. - `/docs/architecture-decisions/`: contains the architecture decisions for the project. All new source files

apacheAGENTS.md

kafka

apache/kafka/AGENTS.md

Agent Guide for Apache Kafka This file is read by automated agents (security scanners, code analyzers, AI assistants) operating on this repository. ## Project overview Apache Kafka is a distributed event

OWASPAGENTS.md

CheatSheetSeries

OWASP/CheatSheetSeries/AGENTS.md

tools most often break. > The audience for every cheat sheet is **developers, not security experts**. Content must be accurate, practical, concise, and opinionated. We would rather have _good_ advice

Yeachan-HeoAGENTS.md

oh-my-codex / templates

Yeachan-Heo/oh-my-codex/templates/AGENTS.md

missing authority, or an irreversible/destructive branch. - Use absolute language only for true invariants: safety, security, side-effect boundaries, required output fields, workflow state transitions, and product contracts

hiddifyAGENTS.md

hiddify-app

hiddify/hiddify-app/AGENTS.md

migration, or API change. **Complex**: several areas, native code, connection/core logic, DB migrations, or security-relevant code. - If the change spans repos (e.g. hiddify-core), link the related PR. ## Opening

alibabaAGENTS.md

nacos

alibaba/nacos/AGENTS.md

Distributed Lock Spec](./specs/en/lock/lock-spec.md) - Extension model: [Integration And Adapter Spec](./specs/en/integration/integration-adapter-spec.md), [Plugin Specs](./specs/en/plugin/README.md) - Security model: [Auth And Permission Spec](./specs/en/auth/auth-permission-spec.md), [Auth Plugin Spec](./specs/en/auth/auth-plugin-spec.md), [RAM Auth Plugin Spec](./specs/en/auth/ram-auth-plugin-spec.md

No other project uses it yet

telegramdesktopDeletes or force-pushesAGENTS.md

tdesktop

telegramdesktop/tdesktop/AGENTS.md

change, one whose correctness needs a real testing campaign, or one that is safety-, security- or data-safety-critical. Make the offer in one line, say why, and route

VercelAGENTS.md

agent-skills / react-best-practices

vercel-labs/agent-skills/skills/react-best-practices/AGENTS.md

invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation

containersAGENTS.md

podman

containers/podman/AGENTS.md

Makefile** (`make help`, `make binaries`, `make validatepr`); match the **Go** version in `go.mod`. **Security** issues use the private process linked from CONTRIBUTING, not public GitHub. AI-assisted contributions must follow

onyx-dot-appReads credentialsAGENTS.md

onyx

onyx-dot-app/onyx/AGENTS.md

server, web_server, celery_X) will be tailing their logs to this file. ## Security Considerations - Never commit API keys or secrets to the repository - Use the encrypted credential storage

onyx-dot-appAGENTS.md

onyx / mobile

onyx-dot-app/onyx/mobile/AGENTS.md

mock; this also satisfies `import/first`). - Native mocks are centralized: MMKV self-mocks, `expo-secure-store` manual mock in `__mocks__/`, resets in `jest.setup.ts`. - A generic fn like `apiFetch ` makes `jest.mocked()` infer

zeroclaw-labsAGENTS.md

zeroclaw

zeroclaw-labs/zeroclaw/AGENTS.md

module, factory wiring, adjacent tests, and relevant docs before editing. 2. For architecture, config, security, workflow, governance, CI, release, or agent-assisted changes, start with `docs/book/src/contributing/architecture-map.md`. 3. Name the source

No other project uses it yet

conductor-ossAGENTS.md

conductor

conductor-oss/conductor/AGENTS.md

higher versions are always welcome — use one of two lowercase prefixes instead: ```groovy // Security: CVE-2025-12183 — lz4-java minimum patched version // Compat: commons-lang3 3.18.0+ required by Testcontainers/commons-compress ``` - `// Security

FujiwaraChokiReads credentialsAGENTS.md

MoneyPrinterV2

FujiwaraChoki/MoneyPrinterV2/AGENTS.md

description. - Mark not-ready PRs with `WIP` and remove it when ready for review. ## Security & Configuration Tips - Treat `config.json` as environment-specific; do not commit real API keys or private