How real projects brief GitHub Copilot, from .github/copilot-instructions.md.
MicrosoftCopilot instructionsmicrosoft/teams-sdk/.github/copilot-instructions.md
sacrifice grammar for brevity. Every comment MUST include an importance level prefix: - **[CRITICAL]** — Bugs, security issues, data loss. Must fix. - **[HIGH]** — Correctness, perf, or maintainability problems. Should fix. - **[NIT]** — Style
AWSCopilot instructionsawslabs/automated-security-helper/ash-agent-plugins/agentic-coding/plugins/copilot/.github/copilot-instructions.md
Security Scanner Run ASH (Automated Security Helper) security scans via MCP — Bandit, Semgrep, detect-secrets, Checkov, Grype, Syft, and more across Python, JS, IaC, and dependencies. --- # ASH MCP — Security Scanning
getopenpostCopilot instructionsgetopenpost/openpost/.github/copilot-instructions.md
evidence. Never copy a static provider count into product guidance. - Verify product, plan, provider, security, and deployment claims against the current code or an official source before publishing them
FerroxLabsCopilot instructionsFerroxLabs/wayland/.github/copilot-instructions.md
bullets. explain/teach -- only when user says "why" or "explain". Use normal English for: security warnings, destructive actions, user confusion, multi-step sequences. Resume terse after. ## Memory routing Session start: call
MicrosoftCopilot instructionsmicrosoft/go-sqlcmd/.github/copilot-instructions.md
Authentication code is in `pkg/sqlcmd/azure_auth.go` - Supports multiple authentication methods: DefaultAzureCredential, Password, Interactive, ManagedIdentity, ServicePrincipal ## Security Considerations - Never commit secrets or credentials - Use environment variables or secure credential stores for sensitive
thunder-idCopilot instructionsthunder-id/thunderid/.github/copilot-instructions.md
guidelines are defined in [`AGENTS.md`](../AGENTS.md). Additional references: - REST API design: https://wso2.com/whitepapers/wso2-rest-apis-design-guidelines/ - Secure coding: https://security.docs.wso2.com/en/latest/security-guidelines/secure-engineering-guidelines/secure-coding-guidlines/general-recommendations-for-secure-coding/ - Documentation guidelines: [`docs/AGENTS.md`](../docs/AGENTS.md
JayPokaleCopilot instructionsJayPokale/Chisle/.github/copilot-instructions.md
Never minimal about:** input validation at trust boundaries, error handling that prevents data loss, security, accessibility, anything explicitly requested. Always on once installed. Deactivate: "stop chisle" / "normal mode
MicrosoftCopilot instructionsmicrosoft/WindowsProtocolTestSuites/.github/copilot-instructions.md
base types | | **TransportStack** | Network transport implementations (TCP, UDP, named pipes, RDP virtual channels) | | **Sspi/SspiLib** | Security Support Provider Interface (NTLM, Kerberos, Negotiate authentication) | | **CryptoLib** | Cryptographic operations (AES-CCM, AES-GCM, encryption/decryption
Microsoft AzureCopilot instructionsAzure/karpenter-provider-azure/.github/copilot-instructions.md
short form; `AGENTS.md` is the source of truth. ## Priorities Review for correctness, security, and backward compatibility, in that order. Focus on architecture, logic bugs, and failure modes. Reason about
MicrosoftCopilot instructionsmicrosoft/pxt-arcade/.github/copilot-instructions.md
Firefox, Safari, Edge) - Mobile device compatibility - Hardware device compatibility - Backward compatibility with existing projects ### Security Guidelines: - Follow Microsoft security policies - Validate user-generated content - Secure handling of shared projects - Privacy
nodetool-aiCopilot instructionsnodetool-ai/nodetool/.github/copilot-instructions.md
dynamic imports for large components: ```typescript // ✅ Good const HeavyComponent = React.lazy(() => import('./HeavyComponent')); <Suspense fallback={ }> ``` ## Security ### Sanitize User Input ```typescript // ✅ Good import DOMPurify from 'dompurify'; const sanitizedHtml = DOMPurify.sanitize(userInput); ``` ### Avoid Dangerous
gitmono-devCopilot instructionsgitmono-dev/mega/.github/copilot-instructions.md
secrets. - Provide actionable error messages (context via anyhow::Context), and map OS/IO errors precisely. ## Security & compliance - No plaintext secrets, keys, or tokens in code or tests. - Default to Rustls
MicrosoftCopilot instructionsmicrosoft/AL-Go/.github/copilot-instructions.md
modules with explicit paths: `Join-Path $PSScriptRoot` pattern. - Use `-Force -DisableNameChecking` for re-imports. ## Security Patterns ### Secret Handling - Mask secrets with `Write-Host "::add-mask::$secret"` before any output. - Never
MicrosoftCopilot instructionsmicrosoft/xdp-for-windows/.github/copilot-instructions.md
ring perf, RX filter perf 5. **Fuzz Tests**: Packet parsing fuzzer (pktfuzz) 6. **CodeQL**: Security analysis (on scheduled runs) CI uses test-signed drivers and requires test signing enabled
ZaxbyHubCopilot instructionsZaxbyHub/opencode-swarm/.github/copilot-instructions.md
Standards These standards apply to all Copilot interactions including code generation and PR review. ## Security - Never hardcode secrets, tokens, API keys, or connection strings — use environment variables or a vault
MicrosoftCopilot instructionsmicrosoft/mssql-python/.github/copilot-instructions.md
integration cases (VARBINARY, UNIQUEIDENTIFIER, XML, DECIMAL, stored-proc params) before applying the optimization broadly. ## Security and credentials - **Committed connection strings that contain `UID`/`PWD` must use `SERVER=localhost
AvdLeeCopilot instructionsAvdLee/Swift-Testing-Agent-Skill/.github/copilot-instructions.md
confirmations where needed. - Parallelization guidance prioritizes fixing isolation over blanket serialization. 5. **Safety / Security (for automation & scripts)** - GitHub Actions and scripts should avoid surprising network behavior and avoid writing outside
MicrosoftCopilot instructionsmicrosoft/SqlNexus/.github/copilot-instructions.md
clearly-labeled scaffolding test and a TODO explaining the required wiring (project reference / InternalsVisibleTo). ## Security requirements (Microsoft SDL — always build in this spirit) - **No injection.** Never build SQL, shell
MicrosoftCopilot instructionsmicrosoft/RAMPART/.github/copilot-instructions.md
selective. Only leave comments for issues that genuinely matter: - Bugs, logic errors, or security concerns - Unclear code that would benefit from refactoring for readability - Violations of the critical coding conventions
Community-AccessCopilot instructionsCommunity-Access/accessibility-agents/.github/copilot-instructions.md
manager, contributions-hub, insiders-a11y-tracker, template-builder, repo-manager, projects-manager, actions-manager, security-dashboard, release-manager, notifications-manager, wiki-manager - **Developer Tools** - led by developer-hub; routes
Repository-wide instructions for GitHub Copilot, kept in .github/copilot-instructions.md.
How to build and test, the project's structure, and the conventions Copilot should follow in suggestions and reviews.
No. Copilot's coding agent also reads AGENTS.md, so many projects keep the shared rules there.
Open a file to see its discussion. Reports from people and their agents are coming.
