How real projects brief GitHub Copilot, from .github/copilot-instructions.md.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
harvesterCopilot instructionsharvester/harvester/.github/copilot-instructions.md
conventions outlined below to ensure consistency and maintainability. Pay particular attention to the [Security Checks](#security-checks) section below. ## Go Conventions - Go version: see `go.mod` (`go` directive) - All code must
dubzzzCopilot instructionsdubzzz/fast-check/.github/copilot-instructions.md
configuration files - 🎨 Improve structure/format of the code - 🔥 Remove code or files - 🚀 Deploy stuff - 🔒️ Fix security or privacy issues - ⬆️ Upgrade dependencies - ⬇️ Downgrade dependencies - 📦 Add or update compiled files or packages
No other project uses it yet
baomidouCopilot instructionsbaomidou/dynamic-datasource/.github/copilot-instructions.md
configuration properties belong in `DynamicDataSourceProperties` and must be documented at https://doc.xiuceyun.cn (separate repository). - Security findings are **not** public issues: see `SECURITY.md
Steady3 mentions in 2 weeks
No other project uses it yet
nginxCopilot instructionsnginx/kubernetes-ingress/.github/copilot-instructions.md
before `nic-code-review`. Never load it for local reviews | --- ## Key Invariants - **NGINX config security**: Run `containsDangerousChars()` on every user-provided string that reaches NGINX config (dangerous: `;`, `{`, `}`, `\n`, `\r`, `$`, backtick
xvzcCopilot instructionsxvzc/spoofdpi/.github/copilot-instructions.md
Senior Go Backend Engineer and Security Auditor. Review the following code with a strict focus on **CRITICAL BUGS** and **STABILITY ISSUES**. **🚫 IGNORE the following (Do NOT report):** - Coding style, formatting
canonicalCopilot instructionscanonical/lxd/.github/copilot-instructions.md
Copilot Instructions LXD is a modern, secure system container and virtual machine manager. LXD requires the Go version listed in `doc/requirements.md` or higher and is only tested with the Golang
dotnetCopilot instructionsdotnet/docs/.github/copilot-instructions.md
tokenizer" instead of "Cache and reuse the tokenizer for better performance". Write "To improve security, use HTTPS" instead of "Use HTTPS to improve security". ## Special Cases ### Breaking Changes - Include directions
hyperlight-devCopilot instructionshyperlight-dev/hyperlight/.github/copilot-instructions.md
weight these for Hyperlight: * Correctness: edge cases, error paths, broken invariants. * Security boundary: the VMM/guest split, paging, and syscall surface. Treat all guest input as untrusted and watch for sandbox
Steady10 mentions in 2 weeks
No other project uses it yet
dmno-devReads credentialsCopilot instructionsdmno-dev/varlock/.github/copilot-instructions.md
Copilot PR code review (security) **Scope:** Focus on **code** security. Copilot does not review dependency manifests or lockfiles; rely on Dependabot, CodeQL, and the dependency-review workflow for supply chain
Steady19 mentions in 2 weeks
No other project uses it yet
MicrosoftCopilot instructionsmicrosoft/PyRIT/.github/copilot-instructions.md
PyRIT (Python Risk Identification Tool for generative AI) is an open-source framework for security professionals to proactively identify risks in generative AI systems. ## Architecture PyRIT uses a modular pluggable
No other project uses it yet
aquasecurityCopilot instructionsaquasecurity/tracee/.github/copilot-instructions.md
Copilot Instructions for Tracee ## Repository Overview Tracee is a runtime security and observability tool that uses eBPF technology to tap into system activity and expose events ranging from factual system
Model Context ProtocolCopilot instructionsmodelcontextprotocol/csharp-sdk/.github/copilot-instructions.md
package directories - Use `///` XML comments for all public APIs - Include ` ` sections for detailed explanations ## Security - Never commit secrets or API keys - Use environment variables for sensitive configuration - Support authentication mechanisms
Steady3 mentions in 2 weeks
No other project uses it yet
IvanMurzakCopilot instructionsIvanMurzak/Unity-MCP/.github/copilot-instructions.md
/Packages/com.ivanmurzak.unity.mcp/package.json`. ## Integration Points - **Communication**: SignalR between Server and Plugin. - **Dependencies**: OpenUPM for external packages. ## Security - **Server Transport**: Configurable via `--client-transport` (`stdio` or `streamableHttp
kubernetes-sigsCopilot instructionskubernetes-sigs/agent-sandbox/.github/copilot-instructions.md
substantive findings tied to lines the PR actually modifies — logic bugs, concurrency issues, security vulnerabilities, controller-runtime misuse, API contract breaks, and missing tests for new behavior. - Do NOT flag
No other project uses it yet
dvorkaCopilot instructionsdvorka/hstr/.github/copilot-instructions.md
Application backend is written in C. - Always start comments you generate with lowercase letter. ## Security instructions - ALWAYS follow security best practices. - NEVER log form data that may contain sensitive information
alextselegidisCopilot instructionsalextselegidis/easyappointments/.github/copilot-instructions.md
consistency with existing patterns over introducing new ones. * Keep code clean, readable, and maintainable. ## Security Best Practices * Never introduce vulnerabilities such as: * SQL injection * XSS (Cross-Site Scripting) * CSRF issues
MicrosoftCopilot instructionsmicrosoft/FLAML/.github/copilot-instructions.md
pre-commit-config.yaml`: Pre-commit hook configuration - Backward compatibility: FLAML is a library with external users ### Security Considerations - Never commit secrets or API keys - Be careful with external data sources in tests
No other project uses it yet
MicrosoftCopilot instructionsmicrosoft/ApplicationInspector/.github/copilot-instructions.md
Structure Rules are JSON files located in `AppInspector/rules/default/` organized by category: - `cryptography/` - Cryptographic operations - `security_feature/` - Security-related features (authentication, authorization, etc.) - `data_handling/` - Database, serialization, deserialization - `os/` - Operating system
sshnetCopilot instructionssshnet/SSH.NET/.github/copilot-instructions.md
proxy support (SOCKS4/5, HTTP), key exchange ├── Messages/ # SSH protocol message types │ ├── Transport/ │ ├── Authentication/ │ └── Connection/ ├── Security/ # Algorithms, key-exchange, cryptography wrappers │ └── Cryptography/ # Ciphers, signatures, key types ├── Sftp/ # SFTP session, requests, responses
Steady6 mentions in 2 weeks
No other project uses it yet
MongoDBCopilot instructionsmongodb/mongo-python-driver/.github/copilot-instructions.md
When reviewing code, focus on: ## Security Critical Issues - Check for hardcoded secrets, API keys, or credentials. - Check for instances of potential method call injection, dynamic code execution, symbol injection
Steady4 mentions in 2 weeks
No other project uses it yet
Repository-wide instructions for GitHub Copilot, kept in .github/copilot-instructions.md.
How to build and test, the project's structure, and the conventions Copilot should follow in suggestions and reviews.
No. Copilot's coding agent also reads AGENTS.md, so many projects keep the shared rules there.
Open a file to see its discussion. Reports from people and their agents are coming.
