How real projects brief GitHub Copilot, from .github/copilot-instructions.md.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
pol-riveroCopilot instructionspol-rivero/github-desktop-plus/.github/copilot-instructions.md
files yarn markdownlint # Format with Prettier yarn prettier # Fix Prettier issues yarn prettier --write ``` ## Security & Quality ### Security - **Never commit secrets, passwords, or sensitive data** - **Validate and sanitize user input** - **Follow
wp-mediaCopilot instructionswp-media/wp-rocket/.github/copilot-instructions.md
query without prepare $wpdb->query("UPDATE {$table} SET status = 'active'"); // ✅ GOOD: Use prepare for security $wpdb->query( $wpdb->prepare( "UPDATE {$table} SET status = %s", 'active' ) ); ``` ### 3. Missing Nonce Verification
linuxmintCopilot instructionslinuxmint/cinnamon-spices-applets/.github/copilot-instructions.md
code review, always check for these issues. Flag any violations as high severity. ### Security (all xlet types) - Check for command/shell injection opportunities: Functions that take an argument array variant should
MicrosoftCopilot instructionsmicrosoft/teams-sdk/.github/copilot-instructions.md
sacrifice grammar for brevity. Every comment MUST include an importance level prefix: - **[CRITICAL]** — Bugs, security issues, data loss. Must fix. - **[HIGH]** — Correctness, perf, or maintainability problems. Should fix. - **[NIT]** — Style
JayPokaleCopilot instructionsJayPokale/Chisle/.github/copilot-instructions.md
Never minimal about:** input validation at trust boundaries, error handling that prevents data loss, security, accessibility, anything explicitly requested. Always on once installed. Deactivate: "stop chisle" / "normal mode
AWSCopilot instructionsawslabs/automated-security-helper/ash-agent-plugins/agentic-coding/plugins/copilot/.github/copilot-instructions.md
Security Scanner Run ASH (Automated Security Helper) security scans via MCP — Bandit, Semgrep, detect-secrets, Checkov, Grype, Syft, and more across Python, JS, IaC, and dependencies. --- # ASH MCP security scanning
DoezerReads credentialsCopilot instructionsDoezer/Questarr/.github/copilot-instructions.md
server/auth.ts`. 5. **Input Validation**: Validate requests with express-validator middleware in `server/middleware.ts`. 6. **Security**: Use `safeFetch()` from `server/ssrf.ts` for any outbound HTTP requests to prevent SSRF. 7. **Environment Variables
andrechristikanReads credentialsCopilot instructionsandrechristikan/ack-nestjs-boilerplate/.github/copilot-instructions.md
HTTP status via `DocResponseEntryMetaKey` so stacked kits compose. Paginated success uses `baseSchema: ResponsePaginationSchema`. - **OpenAPI security scheme names are module consts** (`AuthJwtAccessDocSecurityName = 'accessToken'`, …, `ApiKeyDocSecurityName = 'xApiKey'`), never magic strings at `ApiBearerAuth` / `ApiSecurity
MicrosoftCopilot instructionsmicrosoft/azure-genai-design-patterns/.github/copilot-instructions.md
asset must reside inside one of the eight categories under `assets/`: - `m365-and-copilot` - `security-and-governance` - `landing-zones-and-infra` - `agent-runtime` - `ai-gateway` - `orchestration-and-workflows` - `agentops
scalityReads credentialsCopilot instructionsscality/Zenko/.github/copilot-instructions.md
types, or changed `ZenkoVersion` CR shape must be called out — they break deployed operators. | | **Security** | OWASP-relevant issues for web/API code in tests; overly permissive RBAC, hostPath/hostNetwork usage, privileged containers
ohcnetworkReads credentialsCopilot instructionsohcnetwork/care_fe/.github/copilot-instructions.md
fast development iteration - Memory management optimizations for large codebase - Plugin federation for modular architecture ## Security and Compliance ### Security Measures - Regular dependency updates via Renovate - Snyk security scanning and vulnerability auditing
opentibiabrCopilot instructionsopentibiabr/canary/.github/copilot-instructions.md
Keep fixes narrow and reviewable. - Do not modify `.github/**`, CI, release, secret, funding, or security configuration unless the task is specifically about those files. - Do not install new dependencies unless
ZhuoZhuoCrayonCopilot instructionsZhuoZhuoCrayon/throttled-py/.github/copilot-instructions.md
tests are added for new features - [ ] Documentation is updated for API changes - [ ] No security vulnerabilities introduced - [ ] Performance considerations are addressed - [ ] Error handling is comprehensive - [ ] Code is readable and maintainable
github-copilot-resourcesReads credentialsCopilot instructionsgithub-copilot-resources/copilot-metrics-viewer/.github/copilot-instructions.md
Nuxt 3 web application for GitHub Copilot usage metrics and analytics
4regabCopilot instructions4regab/TaskSync/.github/copilot-instructions.md
interface — do not add direct imports from `webviewProvider.ts`. This prevents circular dependencies. ## Security Best Practices Follow OWASP Top 10 principles. Specific patterns enforced in this codebase: - **Timing-safe comparison
ZcashFoundationCopilot instructionsZcashFoundation/zebra/.github/copilot-instructions.md
safety, lifetime/ownership across boundaries ## Output Format Categorize findings by severity: - **BLOCKER**: Must fix (bugs, security, correctness, consensus safety) - **IMPORTANT**: Should fix (maintainability, likely future bugs) - **SUGGESTION**: Optional improvement - **NITPICK**: Minor
provosReads credentialsCopilot instructionsprovos/ironcurtain/.github/copilot-instructions.md
IronCurtain Copilot Review Instructions IronCurtain is a secure agent runtime that mediates between an AI agent and MCP servers. Every tool call passes through a trusted process that evaluates
FerroxLabsCopilot instructionsFerroxLabs/wayland/.github/copilot-instructions.md
bullets. explain/teach -- only when user says "why" or "explain". Use normal English for: security warnings, destructive actions, user confusion, multi-step sequences. Resume terse after. ## Memory routing Session start: call
nodetool-aiReads credentialsCopilot instructionsnodetool-ai/nodetool/.github/copilot-instructions.md
dynamic imports for large components: ```typescript // ✅ Good const HeavyComponent = React.lazy(() => import('./HeavyComponent')); <Suspense fallback={ }> ``` ## Security ### Sanitize User Input ```typescript // ✅ Good import DOMPurify from 'dompurify'; const sanitizedHtml = DOMPurify.sanitize(userInput); ``` ### Avoid Dangerous
SigmaHQCopilot instructionsSigmaHQ/pySigma/.github/copilot-instructions.md
Rule validation logic - `tests/` - Test suite - `docs/` - Sphinx documentation ## Important Considerations - This is a security-focused library - code quality and correctness are critical - Changes should maintain backward compatibility when possible
Repository-wide instructions for GitHub Copilot, kept in .github/copilot-instructions.md.
How to build and test, the project's structure, and the conventions Copilot should follow in suggestions and reviews.
No. Copilot's coding agent also reads AGENTS.md, so many projects keep the shared rules there.
Open a file to see its discussion. Reports from people and their agents are coming.
