How real projects brief GitHub Copilot, from .github/copilot-instructions.md.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
DoezerReads credentialsCopilot instructionsDoezer/Questarr/.github/copilot-instructions.md
server/auth.ts`. 5. **Input Validation**: Validate requests with express-validator middleware in `server/middleware.ts`. 6. **Security**: Use `safeFetch()` from `server/ssrf.ts` for any outbound HTTP requests to prevent SSRF. 7. **Environment Variables
andrechristikanReads credentialsCopilot instructionsandrechristikan/ack-nestjs-boilerplate/.github/copilot-instructions.md
HTTP status via `DocResponseEntryMetaKey` so stacked kits compose. Paginated success uses `baseSchema: ResponsePaginationSchema`. - **OpenAPI security scheme names are module consts** (`AuthJwtAccessDocSecurityName = 'accessToken'`, …, `ApiKeyDocSecurityName = 'xApiKey'`), never magic strings at `ApiBearerAuth` / `ApiSecurity
MicrosoftCopilot instructionsmicrosoft/azure-genai-design-patterns/.github/copilot-instructions.md
asset must reside inside one of the eight categories under `assets/`: - `m365-and-copilot` - `security-and-governance` - `landing-zones-and-infra` - `agent-runtime` - `ai-gateway` - `orchestration-and-workflows` - `agentops
ohcnetworkReads credentialsCopilot instructionsohcnetwork/care_fe/.github/copilot-instructions.md
fast development iteration - Memory management optimizations for large codebase - Plugin federation for modular architecture ## Security and Compliance ### Security Measures - Regular dependency updates via Renovate - Snyk security scanning and vulnerability auditing
scalityReads credentialsCopilot instructionsscality/Zenko/.github/copilot-instructions.md
types, or changed `ZenkoVersion` CR shape must be called out — they break deployed operators. | | **Security** | OWASP-relevant issues for web/API code in tests; overly permissive RBAC, hostPath/hostNetwork usage, privileged containers
opentibiabrCopilot instructionsopentibiabr/canary/.github/copilot-instructions.md
Keep fixes narrow and reviewable. - Do not modify `.github/**`, CI, release, secret, funding, or security configuration unless the task is specifically about those files. - Do not install new dependencies unless
ZhuoZhuoCrayonCopilot instructionsZhuoZhuoCrayon/throttled-py/.github/copilot-instructions.md
tests are added for new features - [ ] Documentation is updated for API changes - [ ] No security vulnerabilities introduced - [ ] Performance considerations are addressed - [ ] Error handling is comprehensive - [ ] Code is readable and maintainable
github-copilot-resourcesReads credentialsCopilot instructionsgithub-copilot-resources/copilot-metrics-viewer/.github/copilot-instructions.md
Nuxt 3 web application for GitHub Copilot usage metrics and analytics
4regabCopilot instructions4regab/TaskSync/.github/copilot-instructions.md
interface — do not add direct imports from `webviewProvider.ts`. This prevents circular dependencies. ## Security Best Practices Follow OWASP Top 10 principles. Specific patterns enforced in this codebase: - **Timing-safe comparison
ZcashFoundationCopilot instructionsZcashFoundation/zebra/.github/copilot-instructions.md
safety, lifetime/ownership across boundaries ## Output Format Categorize findings by severity: - **BLOCKER**: Must fix (bugs, security, correctness, consensus safety) - **IMPORTANT**: Should fix (maintainability, likely future bugs) - **SUGGESTION**: Optional improvement - **NITPICK**: Minor
nodetool-aiReads credentialsCopilot instructionsnodetool-ai/nodetool/.github/copilot-instructions.md
dynamic imports for large components: ```typescript // ✅ Good const HeavyComponent = React.lazy(() => import('./HeavyComponent')); <Suspense fallback={ }> ``` ## Security ### Sanitize User Input ```typescript // ✅ Good import DOMPurify from 'dompurify'; const sanitizedHtml = DOMPurify.sanitize(userInput); ``` ### Avoid Dangerous
provosReads credentialsCopilot instructionsprovos/ironcurtain/.github/copilot-instructions.md
IronCurtain Copilot Review Instructions IronCurtain is a secure agent runtime that mediates between an AI agent and MCP servers. Every tool call passes through a trusted process that evaluates
asgardeoCopilot instructionsasgardeo/thunder/.github/copilot-instructions.md
guidelines are defined in [`AGENTS.md`](../AGENTS.md). Additional references: - REST API design: https://wso2.com/whitepapers/wso2-rest-apis-design-guidelines/ - Secure coding: https://security.docs.wso2.com/en/latest/security-guidelines/secure-engineering-guidelines/secure-coding-guidlines/general-recommendations-for-secure-coding/ - Documentation guidelines: [`docs/AGENTS.md`](../docs/AGENTS.md
FerroxLabsCopilot instructionsFerroxLabs/wayland/.github/copilot-instructions.md
bullets. explain/teach -- only when user says "why" or "explain". Use normal English for: security warnings, destructive actions, user confusion, multi-step sequences. Resume terse after. ## Memory routing Session start: call
SigmaHQCopilot instructionsSigmaHQ/pySigma/.github/copilot-instructions.md
Rule validation logic - `tests/` - Test suite - `docs/` - Sphinx documentation ## Important Considerations - This is a security-focused library - code quality and correctness are critical - Changes should maintain backward compatibility when possible
pickles4evaaaaDeletes or force-pushesCopilot instructionspickles4evaaaa/mybibliotheca/.github/copilot-instructions.md
memory registry then query `MATCH (j:ImportJob {id: ' '}) RETURN j` for persisted record. ### 9. Security & Multi-User * Isolation via relationships—never return a Book unless verified via an owning `OWNS
MicrosoftCopilot instructionsmicrosoft/go-sqlcmd/.github/copilot-instructions.md
Authentication code is in `pkg/sqlcmd/azure_auth.go` - Supports multiple authentication methods: DefaultAzureCredential, Password, Interactive, ManagedIdentity, ServicePrincipal ## Security Considerations - Never commit secrets or credentials - Use environment variables or secure credential stores for sensitive
agentic-inCopilot instructionsagentic-in/elephant-agent/.github/copilot-instructions.md
enforced mechanically when practical Then review the implementation for bugs, regressions, missing validation, security issues, and maintainability risks. ## Harness-Specific Checks - For harness changes, verify alignment with `docs/agent/governance.md`, `docs/agent/testing-strategy.md`, `docs/agent/feature-complete-checklist.md
magicbugReads credentialsCopilot instructionsmagicbug/Cloudlog/.github/copilot-instructions.md
site_url`, `my_call` - Language strings: `<?php echo lang('key'); ?>` (files in `application/language/`) ### Security - Input sanitization: `$this->security->xss_clean($input)` - Prevent direct access: `if (!defined('BASEPATH')) exit('No direct
emmansunCopilot instructionsemmansun/gmsm/.github/copilot-instructions.md
assembly) - Pure Go versions: ` _generic.go` with build tag `//go:build purego || !(amd64 || ...)` ## Security Patterns ### Constant-Time Operations - **Padding removal**: All padding schemes in `padding/` provide `ConstantTimeUnpad()` to prevent timing attacks
Repository-wide instructions for GitHub Copilot, kept in .github/copilot-instructions.md.
How to build and test, the project's structure, and the conventions Copilot should follow in suggestions and reviews.
No. Copilot's coding agent also reads AGENTS.md, so many projects keep the shared rules there.
Open a file to see its discussion. Reports from people and their agents are coming.
