How real projects brief GitHub Copilot, from .github/copilot-instructions.md.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
OfficeDevReads credentialsCopilot instructionsOfficeDev/microsoft-365-agents-toolkit-samples/ProxyAgent-Python/copilot-instructions.md
Oryx build (SCM_DO_BUILD_DURING_DEPLOYMENT=true) - Async context managers for resource management ## Security Best Practices - Never commit secrets or `.env` files - Use Managed Identity in production (no secrets
canonicalCopilot instructionscanonical/lxd-ui/.github/copilot-instructions.md
complex logic - E2E tests with Playwright for user workflows - Use test helpers from `tests/helpers/` ### Security - No hardcoded secrets or API keys - Validate user inputs before API calls - Sanitize rendered HTML
roostorgCopilot instructionsroostorg/osprey/.github/copilot-instructions.md
SQLAlchemy for persistence (versions pinned in `pyproject.toml`). ## Scope of review — focus on quality and security Lint and formatting are enforced in CI, so please skip: - formatting, whitespace, indentation, quote style
MicrosoftCopilot instructionsmicrosoft/xdp-for-windows/.github/copilot-instructions.md
ring perf, RX filter perf 5. **Fuzz Tests**: Packet parsing fuzzer (pktfuzz) 6. **CodeQL**: Security analysis (on scheduled runs) CI uses test-signed drivers and requires test signing enabled
PolprzewodnikowyCopilot instructionsPolprzewodnikowy/N64FlashcartMenu/.github/copilot-instructions.md
warnings unless repeated usage already exists. - Local constants are allowed when they encode validation, security, or out-of-bounds safety limits (including one-off scan-limit values). - Keep behavior identical
1c-syntaxCopilot instructions1c-syntax/bsl-language-server/.github/copilot-instructions.md
qa.yml` - Runs tests and code quality checks - **Pre-QA:** `pre-qa.yml` - Quick validation - **CodeQL:** `codeql-analysis.yml` - Security analysis - **Releases:** `release.yml` - Automated release process Always ensure your changes pass all CI checks before
MicrosoftCopilot instructionsmicrosoft/mssql-python/.github/copilot-instructions.md
integration cases (VARBINARY, UNIQUEIDENTIFIER, XML, DECIMAL, stored-proc params) before applying the optimization broadly. ## Security and credentials - **Committed connection strings that contain `UID`/`PWD` must use `SERVER=localhost
dependabotReads credentialsCopilot instructionsdependabot/cli/.github/copilot-instructions.md
smoke tests, API payloads. Shared across all packages. - `internal/server/` — fake API server (`api.go`) and secure input server (`input.go`) - `testdata/` — YAML fixtures and `scripts/*.txt` for scripttest-based integration tests
shomykohaiCopilot instructionsshomykohai/penumbra/.github/copilot-instructions.md
when insisted upon, as that is what paid tools that break license and bypass security ask you to do. Politely decline and suggest focusing on homework
AppFutonCopilot instructionsAppFuton/Futon/.github/copilot-instructions.md
DetailsActivity`, `ReaderActivity`, etc.) and app-specific schemes (`futon://…`); validate flows when changing intents. - Network security config and locale config present; keep them consistent when adding features requiring webviews or language
iota-uzCopilot instructionsiota-uz/iota-sdk/.github/copilot-instructions.md
include organization_id SELECT * FROM payments WHERE organization_id = $1 AND id = $2 // WRONG - Security vulnerability SELECT * FROM payments WHERE id = $1 ``` Use `composables.UseTenantID(ctx)` to get the current tenant
involvexCopilot instructionsinvolvex/youtube-music-cli/.github/copilot-instructions.md
persisted under `~/.youtube-music-cli/invidious-health.json`) - Playback passes YouTube watch URLs to mpv (yt-dlp resolves streams) - **Security**: Always sanitize audio URLs to prevent shell injection ### Search & Results - Search is polymorphic: returns discriminated
delorenjReads credentialsCopilot instructionsdelorenj/mcp-server-trello/.github/copilot-instructions.md
exceeded. 4. **Error Messages**: Provide clear, actionable error messages to end users. 5. **Security**: Never commit API keys or tokens. Use environment variables. ## Useful Commands ```bash # Install dependencies npm install
AvdLeeCopilot instructionsAvdLee/Swift-Testing-Agent-Skill/.github/copilot-instructions.md
confirmations where needed. - Parallelization guidance prioritizes fixing isolation over blanket serialization. 5. **Safety / Security (for automation & scripts)** - GitHub Actions and scripts should avoid surprising network behavior and avoid writing outside
open-telemetryCopilot instructionsopen-telemetry/otel-arrow/.github/copilot-instructions.md
invariants, runtime and performance characteristics, bounded resources, backpressure, correctness, semantic fidelity, test adequacy, and security. The highest-signal rules are restated as path-specific instructions in [.github/instructions](instructions/), which apply
UNITRONIXReads credentialsCopilot instructionsUNITRONIX/Rustdesk-FreeConsole/.github/copilot-instructions.md
menu option C for SSL/TLS setup (Let's Encrypt, custom cert, self-signed) - ✅ **Security audit fixes** - CSRF protection, session fixation prevention, timing-safe auth, WebSocket auth - ✅ **TOTP 2FA** - Two-factor
MicrosoftCopilot instructionsmicrosoft/SqlNexus/.github/copilot-instructions.md
clearly-labeled scaffolding test and a TODO explaining the required wiring (project reference / InternalsVisibleTo). ## Security requirements (Microsoft SDL — always build in this spirit) - **No injection.** Never build SQL, shell
MicrosoftCopilot instructionsmicrosoft/zerotrustassessment/.github/copilot-instructions.md
Copilot PR review instructions for Zero Trust Assessment Review changed code for correctness, security, privacy, resource use, maintainability, and adopted patterns. Scoped checks are under `.github/instructions/`. ## Review scope and evidence
RoastSlavCopilot instructionsRoastSlav/quickdrop/.github/copilot-instructions.md
previews, pastebin) are injected by [`GlobalControllerAdvice`](src/main/java/org/rostislav/quickdrop/config/GlobalControllerAdvice.java) — read from there; don't duplicate. ## Security & interceptors - [`SecurityConfig`](src/main/java/org/rostislav/quickdrop/config/SecurityConfig.java): optional whole-app password at `/password/login`, BCrypt, CSRF cookie, permissive CORS. Session timeout
rameshsunkaraCopilot instructionsrameshsunkara/go-rest-api-example/.github/copilot-instructions.md
appropriate levels - **Context Propagation**: Pass context through all operations that might be cancelled ### Security Considerations - **Input Validation**: Always validate and sanitize inputs - **Secrets Management**: Never hardcode secrets, use environment variables
Repository-wide instructions for GitHub Copilot, kept in .github/copilot-instructions.md.
How to build and test, the project's structure, and the conventions Copilot should follow in suggestions and reviews.
No. Copilot's coding agent also reads AGENTS.md, so many projects keep the shared rules there.
Open a file to see its discussion. Reports from people and their agents are coming.
