How real projects brief GitHub Copilot, from .github/copilot-instructions.md.
LazyWorkshopCreateCopilot instructionsLazyWorkshopCreate/agent-based-workflow/.github/copilot-instructions.md
observability** — production alerting, tracing, health checks. - **Incident response** — runbooks, escalation procedures, post-mortem templates. - **Security review** — threat modeling, penetration testing, compliance checks. Add domain-specific skills or prompts to cover
MadaBurnsCopilot instructionsMadaBurns/bv-mcp/.github/copilot-instructions.md
Chaos testing: Run `python3 scripts/chaos/chaos-test-clients.py` to validate behavior across all 9 MCP client types. ## Security and Internal Routes - Keep SSRF protections and domain sanitization paths intact. - Public traffic must
MicrosoftCopilot instructionsmicrosoft/purview-dlm-mcp/.github/copilot-instructions.md
Pure diagnostic evaluation engine (10 TSGs) | | `src/logger.ts` | Append-only execution log with Markdown export | ## Security Constraints - **Read-only only:** Only `Get-*`, `Test-*`, `Export-*` cmdlets are allowed. - **Blocked verbs
prasad-vennamCopilot instructionsprasad-vennam/Awesome-Android-AI-Agent-Skills/.github/copilot-instructions.md
analysis, detecting code smells, or configuring Detekt for Android. - **File Path**: `skills/android-detekt-expert/SKILL.md` ## android-enterprise-security - **Scope**: Deep-dive skills for banking and healthcare apps. - **File Path**: `skills/android-enterprise-security/SKILL.md` ## android-gemini-nano
Ricky-GCopilot instructionsRicky-G/azure-scenario-hub/.github/copilot-instructions.md
Azure Verified Modules](https://aka.ms/avm). Application and AI scenarios must identify the additional security, identity, reliability, and compliance work required before production use. --- ## 🏗️ Repository Structure ``` azure-scenario-hub/ ├── .github
rynald0cst0ltziamCopilot instructionsrynald0cst0ltziam/Warden-AI/.github/copilot-instructions.md
after the clear part is done. This is not optional — safety beats token savings: - Security warnings - Irreversible action confirmations (delete, drop, force-push, overwrite, deploy) - Multi-step sequences where fragment
tosin2013Copilot instructionstosin2013/documcp/.github/copilot-instructions.md
import type { MyType } from './types.js'` - File URLs: `fileURLToPath(import.meta.url)` and `dirname()` ### Path & Permission Handling - **Security**: Use `isPathAllowed(path, allowedRoots)` from `src/utils/permission-checker.ts` before file operations - **Async FS**: Always use `fs.promises
tylerbutlerCopilot instructionstylerbutler/repoverlay/.github/copilot-instructions.md
lint is allowed). - **Error handling**: `anyhow::Result` for application errors, `thiserror` for typed errors. - **Security**: Path components (org, repo, overlay names) are validated against traversal attacks. Repository URLs must
Microsoft AzureCopilot instructionsAzure/c-logging/.github/copilot-instructions.md
MODULE_##_###` format - **Include What You Use (IWYU)**: Build pipeline includes header dependency validation - **CodeQL**: Security analysis through c-build-tools pipeline integration - **Cross-Platform**: Validation on both Windows and Linux
GitHubCopilot instructionsgithub/empty-repos/.github/copilot-instructions.md
definitions ├── CODE_OF_CONDUCT.md # Community guidelines ├── CONTRIBUTING.md # Contribution instructions ├── LICENSE # MIT license ├── README.md # Repository documentation ├── SECURITY.md # Security policy └── SUPPORT.md # Support information ``` ### Key Files to Monitor - **Primary**: `.github/workflows/empty-repos.yml` - All workflow logic - **Documentation**: README.md
huskerCopilot instructionshusker/a2acast/.github/copilot-instructions.md
unions, no 3.9+ stdlib. - **Tests:** `python3 -m unittest discover -s tests` (`python` on Windows) ## Security-relevant changes Crypto, identity, pins, certs, revocation, verdicts, wire format, or anything
MicrosoftCopilot instructionsmicrosoft/wssd-sdk-for-go/.github/copilot-instructions.md
includes `make all`) - Unit Tests job - Lint job (runs golangci-lint) - Static Analysis job (security scans) - **GitHub Actions**: Check that all GitHub Actions workflows are passing - CodeQL analysis - Dependency review
Neneka448Copilot instructionsNeneka448/gogoclaw/.github/copilot-instructions.md
threshold - Only leave a comment when you find a plausible behavioral defect, operational risk, security issue, data consistency issue, or maintainability issue with clear production impact. - Prefer no comment over
SebastienDegodezCopilot instructionsSebastienDegodez/skraft-plugin/.github/copilot-instructions.md
user already has. Code blocks, file paths, commands, error messages: always written in full. Security warnings and destructive action confirmations: use full clarity
shigechikaCopilot instructionsshigechika/mcp-stdio/.github/copilot-instructions.md
going to stderr is a bug, not a style nit. ### 2. Token storage security `token_store.py` persists OAuth tokens at `~/.config/mcp-stdio/tokens.json` (with legacy `~/.mcp-stdio/` migration on read): - The store directory
ajbmachonCopilot instructionsajbmachon/ajbm-skills/.github/copilot-instructions.md
Done" --json` 6. **Sync**: `bd sync` (flushes changes to git immediately) ### Priorities - `0` - Critical (security, data loss, broken builds) - `1` - High (major features, important bugs) - `2` - Medium (default, nice
All-The-VibesCopilot instructionsAll-The-Vibes/ecorp/.github/copilot-instructions.md
github/skills/code-review/SKILL.md` in its read-only review mode. Read `AGENTS.md` and the referenced product, architecture, security, and evaluation contracts. Review the exact PR head against its actual target branch, including draft
damien-schneiderCopilot instructionsdamien-schneider/agent-skills-library/.github/copilot-instructions.md
Prefer simple conditionals over nested ternary operators - Group related code together and separate concerns ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary
HimanshuJ16Copilot instructionsHimanshuJ16/frank/.github/copilot-instructions.md
right". ## On disagreement Name the concrete cost of being wrong (data loss, security, silent failure, money). Then stop. One clear reason beats three hedged ones. ## Receipts When you finish
MicrosoftCopilot instructionsmicrosoft/ContextShare/.github/copilot-instructions.md
order` properties for settings UI organization - Dynamic validation for remote URL schemes (HTTPS-only) ## Security & Privacy Considerations - **Remote Safety**: HTTPS-only remote sources, path traversal protection via `isSafeRelativeEntry()` - **Filename Sanitization
Repository-wide instructions for GitHub Copilot, kept in .github/copilot-instructions.md.
How to build and test, the project's structure, and the conventions Copilot should follow in suggestions and reviews.
No. Copilot's coding agent also reads AGENTS.md, so many projects keep the shared rules there.
Open a file to see its discussion. Reports from people and their agents are coming.
