How real projects brief GitHub Copilot, from .github/copilot-instructions.md.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
vinhnxDeletes or force-pushesCopilot instructionsvinhnx/vtcode/.github/copilot-instructions.md
drop cleanly ## See Also For comprehensive guidelines, see `.github/copilot-instructions.md` (detailed patterns, testing strategy, security, additional context). ## Core System Prompt ```rust r#"You are VT Code, a coding agent. You specialize
GewoonJaapCopilot instructionsGewoonJaap/gemini-cli-openai/.github/copilot-instructions.md
Memory usage**: Optimize for Workers memory constraints - **CPU time**: Avoid long-running synchronous operations ### 🔒 Security Best Practices - **Never log sensitive data** (tokens, credentials) - **Validate all inputs** before processing - **Use proper
getopenpostCopilot instructionsgetopenpost/openpost/.github/copilot-instructions.md
evidence. Never copy a static provider count into product guidance. - Verify product, plan, provider, security, and deployment claims against the current code or an official source before publishing them
MicrosoftCopilot instructionsmicrosoft/CCF/.github/copilot-instructions.md
formal models and proofs; `cmake/`: build helpers. ## Task-specific guidance - For C/C++ changes and security-sensitive reviews in any language, read [security/safety review guidance and C/C++ conventions](/.github/instructions/reviewing.instructions.md). - Before selecting
tt-rssReads credentialsCopilot instructionstt-rss/tt-rss/.github/copilot-instructions.md
starting with underscore (`_`) are blocked from external access - Methods with required parameters are blocked (security measure) - Use `csrf_ignore($method)` to bypass CSRF token validation for specific methods - Examples: `classes/Feeds.php
agentscope-aiCopilot instructionsagentscope-ai/agentscope-runtime/.github/copilot-instructions.md
temporary variables - Merge duplicate code blocks - Prioritize reusing existing utility functions ## 2. [MUST] Code Security - Prohibit hardcoding API keys/tokens/passwords - Use environment variables or configuration files for management - Check for debug
utensilsCopilot instructionsutensils/mcp-nixos/.github/copilot-instructions.md
unrelated tool calls in server.py:** Each MCP tool must be independent 3. **Flake inputs security:** Always validate paths stay within `/nix/store/` (see `_validate_nix_store_path()`) 4. **Line limits:** flake
MicrosoftCopilot instructionsmicrosoft/DirectXMesh/.github/copilot-instructions.md
/walbourn/directxmeshtest/wiki). See [test copilot instructions](https://github.com/walbourn/directxmeshtest/blob/main/.github/copilot-instructions.md) for additional information on the tests. - **Security**: This project uses secure coding practices from the Microsoft Secure Coding Guidelines, and is subject
pol-riveroCopilot instructionspol-rivero/github-desktop-plus/.github/copilot-instructions.md
files yarn markdownlint # Format with Prettier yarn prettier # Fix Prettier issues yarn prettier --write ``` ## Security & Quality ### Security - **Never commit secrets, passwords, or sensitive data** - **Validate and sanitize user input** - **Follow
Microsoft AzurePipes a download into a shellCopilot instructionsAzure/azure-storage-fuse/.github/copilot-instructions.md
blobfuse2-1es_ci.yaml) - **Testing**: Automated on Ubuntu 20/22, both x86 and ARM64 - **Performance**: Dedicated benchmark workflows - **Security**: CodeQL analysis and dependency scanning - **Release**: Automated package building and distribution ## Troubleshooting - **Build Failures**: Check
PaulJPhilpReads credentialsCopilot instructionsPaulJPhilp/EffectPatterns/.github/copilot-instructions.md
yield* AppConfig; const { host, port } = yield* config.getConfig(); }); ``` ### Environment Setup Required environment variables: ```env # API Security PATTERN_API_KEY=your-secret-api-key-here # OpenTelemetry Configuration OTLP_ENDPOINT=http://localhost:4318/v1/traces
LuanRogerCopilot instructionsLuanRoger/electron-shadcn/.github/copilot-instructions.md
Prefer simple conditionals over nested ternary operators - Group related code together and separate concerns ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary
AcademySoftwareFoundationCopilot instructionsAcademySoftwareFoundation/OpenRV/.github/copilot-instructions.md
comment - Do not speculate about hypothetical issues without clear evidence ### What to Review - Security vulnerabilities - Bugs and logic errors - Breaking changes or API changes - Performance issues - Build system issues - Missing
OfficeDevCopilot instructionsOfficeDev/microsoft-365-agents-toolkit/.github/copilot-instructions.md
vscuse-case-diagnosis`** / **`vscuse-scenario-authoring`** skills | | Per-package coding conventions and cross-cutting security rules | `.github/instructions/*.instructions.md` (auto-loaded by `applyTo`) | Pure maintenance (a bug fix, dependency bump, lint
TechStarkCopilot instructionsTechStark/opencv-js/.github/copilot-instructions.md
browser-vs-nodejs-differences) - [Performance and Timing Expectations](#performance-and-timing-expectations) - [Troubleshooting](#troubleshooting) - [Security Considerations](#security-considerations) - [External Documentation](#external-documentation) - [Contributing Guidelines](#contributing-guidelines) ## Working Effectively ### Initial Setup
wp-mediaCopilot instructionswp-media/wp-rocket/.github/copilot-instructions.md
query without prepare $wpdb->query("UPDATE {$table} SET status = 'active'"); // ✅ GOOD: Use prepare for security $wpdb->query( $wpdb->prepare( "UPDATE {$table} SET status = %s", 'active' ) ); ``` ### 3. Missing Nonce Verification
linuxmintCopilot instructionslinuxmint/cinnamon-spices-applets/.github/copilot-instructions.md
code review, always check for these issues. Flag any violations as high severity. ### Security (all xlet types) - Check for command/shell injection opportunities: Functions that take an argument array variant should
JayPokaleCopilot instructionsJayPokale/Chisle/.github/copilot-instructions.md
Never minimal about:** input validation at trust boundaries, error handling that prevents data loss, security, accessibility, anything explicitly requested. Always on once installed. Deactivate: "stop chisle" / "normal mode
MicrosoftCopilot instructionsmicrosoft/teams-sdk/.github/copilot-instructions.md
sacrifice grammar for brevity. Every comment MUST include an importance level prefix: - **[CRITICAL]** — Bugs, security issues, data loss. Must fix. - **[HIGH]** — Correctness, perf, or maintainability problems. Should fix. - **[NIT]** — Style
AWSCopilot instructionsawslabs/automated-security-helper/ash-agent-plugins/agentic-coding/plugins/copilot/.github/copilot-instructions.md
Security Scanner Run ASH (Automated Security Helper) security scans via MCP — Bandit, Semgrep, detect-secrets, Checkov, Grype, Syft, and more across Python, JS, IaC, and dependencies. --- # ASH MCP security scanning
Repository-wide instructions for GitHub Copilot, kept in .github/copilot-instructions.md.
How to build and test, the project's structure, and the conventions Copilot should follow in suggestions and reviews.
No. Copilot's coding agent also reads AGENTS.md, so many projects keep the shared rules there.
Open a file to see its discussion. Reports from people and their agents are coming.
