AGENTS.md examples from real projects

suitenumeriqueReads credentialsAGENTS.md

docs

suitenumerique/docs/AGENTS.md

docker`, `dependencies`, `e2e`, `export`, `auth`, etc. - Gitmoji examples: `✨` feature, `🐛` fix, `♻️` refactor, `⬆️` dependency upgrade, `🔒️` security - Commits must be signed (`-S`) and signed-off (`--signoff`) - One commit = one concern, and the tests

tikvAGENTS.md

tikv

tikv/tikv/AGENTS.md

Resolved timestamp tracking for CDC - `/components/resource_control/` - Resource control and quota management - `/components/security/` - TLS and security utilities - `/components/server/` - Server utilities and status server - `/components/sst_importer/` - SST file import handling - `/components/tikv_util/` - Common utilities

emqxAGENTS.md

emqx

emqx/emqx/AGENTS.md

reasoning from the release numbering, and name the earliest affected branch in the PR. ### Security fixes Apply the same rule, and audit two more cases: sibling code paths that guard

No other project uses it yet

MODSetterReads credentialsAGENTS.md

SurfSense

MODSetter/SurfSense/AGENTS.md

replace the demo video. - Do not commit, push or open a PR unless asked. ## Security - Never commit `.env` or secrets. - Do not put credentials in diffs, logs, or sample payloads

ipythonAGENTS.md

ipython

ipython/ipython/AGENTS.md

differs in a way that matters, and say how under "References" - Report a security vulnerability as described in the [security policy](https://github.com/jupyterlab/jupyterlab/security/policy), instead of opening an issue

kubernetesAGENTS.md

kops

kubernetes/kops/AGENTS.md

TODOs**: Leave no `TODO` comments, placeholders, or incomplete implementations. * **Prioritize Correctness**: Always prioritize security, scalability, and maintainability in your implementations. ### Avoiding Loops When performing complex tasks, especially those involving code

udecodeReads credentialsAGENTS.md

plate

udecode/plate/AGENTS.md

udecode/plate-private issue URL. A Slate issue stays with `maintainer slate-issue`, and a security-shaped report with `maintainer security`. - `.agents/playbooks/verdict.md`, on top of pstack's `investigation`. Use it for `verdict

opensandbox-groupAGENTS.md

OpenSandbox

opensandbox-group/OpenSandbox/AGENTS.md

operations (Kubernetes install, storage, metrics) guides/ # User-facing usage and feature guides (credential vault, secure container, pause/resume, etc.) sdks/ # SDK reference (one page per language per SDK) api/ # OpenAPI spec

Lakr233AGENTS.md

vphone-cli

Lakr233/vphone-cli/AGENTS.md

seals `VPhone.bundle`. `swift build` alone does not produce the distributable bundle. ## Design System - **Audience:** Security researchers. Terminal-adjacent workflow. - **Feel:** Research instrument — precise, informative, no decoration. - **Palette:** Dark neutral (`#1a1a1a

FreshRSSAGENTS.md

FreshRSS

FreshRSS/FreshRSS/AGENTS.md

FreshRSS introduction and conventions for AI agents and human contributors

CloudflareAGENTS.md

cloudflared

cloudflare/cloudflared/AGENTS.md

enabled linters) make lint # Auto-fix formatting make fmt gofmt -w . goimports -w . # Security scanning make vet # Component tests (Python integration tests) cd component-tests && python -m pytest test_file.py::test

No other project uses it yet

SnapchatReads credentialsAGENTS.md

Valdi

Snapchat/Valdi/AGENTS.md

Setup and installation guides ### `/third-party/` External dependencies and their Bazel build configurations ## Important Conventions ### Security: Handling Credentials 1. **Never print credential files or secrets.** When diagnosing setup, install, or registry

apacheDeletes or force-pushesAGENTS.md

doris

apache/doris/AGENTS.md

modify code, build using standard procedures, add and run tests, and submit relevant changes. ## Security Threat Model For security scans, vulnerability triage, security reviews, and changes involving authentication, authorization, network

adobeAGENTS.md

react-spectrum

adobe/react-spectrum/AGENTS.md

open-ended discussion** belong in [Discussions](https://github.com/adobe/react-spectrum/discussions), not the issue tracker. - **Security issues** must not be filed on the public tracker. Follow the process in `CONTRIBUTING.md`. ## Task-specific

YishenTuReads credentialsAGENTS.md

claudian

YishenTu/claudian/AGENTS.md

policy. ## Local conventions - Before adding complexity for a speculative or vanishingly unlikely race or security edge case, explain the concrete failure mode, likelihood, and complexity cost to the user

No other project uses it yet

YishenTuReads credentialsAGENTS.md

claudian / tests

YishenTu/claudian/tests/AGENTS.md

retire an externally reachable plugin or compatibility contract. - Preserve coverage for distinct protocol, platform, security, lifecycle, persistence, and compatibility failures. Consolidation must retain assertions that distinguish those failures. Small tests

No other project uses it yet

HashiCorpAGENTS.md

packer

hashicorp/packer/AGENTS.md

touches the plugin SDK boundary, HCL2 template parsing, the command surface, CI/release workflows, or security-relevant behavior. - Proceed without another confirmation when the user explicitly asks to implement

spreeAGENTS.md

spree

spree/spree/AGENTS.md

author or "generated with" trailers. - Open every pull request with `/open-pr` (code review, security review, open, monitor). A hook blocks a bare `gh pr create` until both reviews have

No other project uses it yet

spreeAGENTS.md

spree / spree

spree/spree/spree/AGENTS.md

rules Rails 8.1 engines, everything namespaced under `Spree::`. Follow Rails conventions and the Rails Security Guide; below is only what Spree does differently. ## Style - New and changed Ruby lines pass

No other project uses it yet

stalwartlabsAGENTS.md

stalwart

stalwartlabs/stalwart/AGENTS.md

support.stalw.art](https://support.stalw.art) first and to read [CONTRIBUTING.md](CONTRIBUTING.md). ## Do not send LLM-generated security reports Do not send security reports to security@stalw.art or through GitHub Security Advisories

No other project uses it yet