AGENTS.md examples from real projects

GoogleReads credentialsAGENTS.md

A2UI / composer

google/A2UI/tools/composer/AGENTS.md

docs and flag follow-ups; ensure CI (`yarn build`) is green before requesting review. ## Security & Configuration Never commit `.env` files or API keys; use `.env.local` for web and `.env` inside

emqxAGENTS.md

emqx

emqx/emqx/AGENTS.md

reasoning from the release numbering, and name the earliest affected branch in the PR. ### Security fixes Apply the same rule, and audit two more cases: sibling code paths that guard

ipythonAGENTS.md

ipython

ipython/ipython/AGENTS.md

differs in a way that matters, and say how under "References" - Report a security vulnerability as described in the [security policy](https://github.com/jupyterlab/jupyterlab/security/policy), instead of opening an issue

MODSetterReads credentialsAGENTS.md

SurfSense

MODSetter/SurfSense/AGENTS.md

replace the demo video. - Do not commit, push or open a PR unless asked. ## Security - Never commit `.env` or secrets. - Do not put credentials in diffs, logs, or sample payloads

kubernetesAGENTS.md

kops

kubernetes/kops/AGENTS.md

TODOs**: Leave no `TODO` comments, placeholders, or incomplete implementations. * **Prioritize Correctness**: Always prioritize security, scalability, and maintainability in your implementations. ### Avoiding Loops When performing complex tasks, especially those involving code

udecodeReads credentialsAGENTS.md

plate

udecode/plate/AGENTS.md

udecode/plate-private issue URL. A Slate issue stays with `maintainer slate-issue`, and a security-shaped report with `maintainer security`. - `.agents/playbooks/verdict.md`, on top of pstack's `investigation`. Use it for `verdict

SnapchatReads credentialsAGENTS.md

Valdi

Snapchat/Valdi/AGENTS.md

Setup and installation guides ### `/third-party/` External dependencies and their Bazel build configurations ## Important Conventions ### Security: Handling Credentials 1. **Never print credential files or secrets.** When diagnosing setup, install, or registry

CloudflareAGENTS.md

cloudflared

cloudflare/cloudflared/AGENTS.md

enabled linters) make lint # Auto-fix formatting make fmt gofmt -w . goimports -w . # Security scanning make vet # Component tests (Python integration tests) cd component-tests && python -m pytest test_file.py::test

opensandbox-groupAGENTS.md

OpenSandbox

opensandbox-group/OpenSandbox/AGENTS.md

operations (Kubernetes install, storage, metrics) guides/ # User-facing usage and feature guides (credential vault, secure container, pause/resume, etc.) sdks/ # SDK reference (one page per language per SDK) api/ # OpenAPI spec

Lakr233AGENTS.md

vphone-cli

Lakr233/vphone-cli/AGENTS.md

seals `VPhone.bundle`. `swift build` alone does not produce the distributable bundle. ## Design System - **Audience:** Security researchers. Terminal-adjacent workflow. - **Feel:** Research instrument — precise, informative, no decoration. - **Palette:** Dark neutral (`#1a1a1a

apacheDeletes or force-pushesAGENTS.md

doris

apache/doris/AGENTS.md

modify code, build using standard procedures, add and run tests, and submit relevant changes. ## Security Threat Model For security scans, vulnerability triage, security reviews, and changes involving authentication, authorization, network

adobeAGENTS.md

react-spectrum

adobe/react-spectrum/AGENTS.md

open-ended discussion** belong in [Discussions](https://github.com/adobe/react-spectrum/discussions), not the issue tracker. - **Security issues** must not be filed on the public tracker. Follow the process in `CONTRIBUTING.md`. ## Task-specific

No other project uses it yet

YishenTuReads credentialsAGENTS.md

claudian

YishenTu/claudian/AGENTS.md

policy. ## Local conventions - Before adding complexity for a speculative or vanishingly unlikely race or security edge case, explain the concrete failure mode, likelihood, and complexity cost to the user

YishenTuReads credentialsAGENTS.md

claudian / tests

YishenTu/claudian/tests/AGENTS.md

retire an externally reachable plugin or compatibility contract. - Preserve coverage for distinct protocol, platform, security, lifecycle, persistence, and compatibility failures. Consolidation must retain assertions that distinguish those failures. Small tests

HashiCorpAGENTS.md

packer

hashicorp/packer/AGENTS.md

touches the plugin SDK boundary, HCL2 template parsing, the command surface, CI/release workflows, or security-relevant behavior. - Proceed without another confirmation when the user explicitly asks to implement

spreeAGENTS.md

spree

spree/spree/AGENTS.md

author or "generated with" trailers. - Open every pull request with `/open-pr` (code review, security review, open, monitor). A hook blocks a bare `gh pr create` until both reviews have

spreeAGENTS.md

spree / spree

spree/spree/spree/AGENTS.md

rules Rails 8.1 engines, everything namespaced under `Spree::`. Follow Rails conventions and the Rails Security Guide; below is only what Spree does differently. ## Architecture - Logic lives in models, concerns

apacheAGENTS.md

hadoop

apache/hadoop/AGENTS.md

Java tests fail. Check the result from ` /target/surefire-reports/` or the `Tests run: ..., Failures: ...` line. ## Security Before investigating, reporting, or acting on any security issue in this repository, you MUST read

open-metadataAGENTS.md

OpenMetadata

open-metadata/OpenMetadata/AGENTS.md

local + prod deployment). ## Hard cross-cutting constraints (apply to every session, all languages) **Secrets & security.** Never commit secrets — use environment variables or a secrets manager. Auth is JWT with OAuth2/SAML

documensoAGENTS.md

documenso

documenso/documenso/AGENTS.md

export const embedAuthRedeemRateLimit = createRateLimit({ action: 'auth.embed-redeem', max: 1200, window: '1m', }); ``` It states a security constraint and the arithmetic behind a magic number. Neither is recoverable from the code. ## Communication