How real projects brief GitHub Copilot, from .github/copilot-instructions.md.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
inspecCopilot instructionsinspec/inspec/.github/copilot-instructions.md
testing framework written in Ruby. It provides a domain-specific language (DSL) for describing security and compliance rules that can be shared between software engineers, operations, and security engineers. ## Additional
MicrosoftCopilot instructionsmicrosoft/mxc/.github/copilot-instructions.md
fails on any reflection-dependent path. See [`docs/development/build-and-test/schema-codegen.md`](../docs/development/build-and-test/schema-codegen.md) for regeneration commands. ## Error and security behavior - Surface errors explicitly using repository error types and include actionable context. - Preserve panic containment
stacks-networkCopilot instructionsstacks-network/stacks-core/.github/copilot-instructions.md
exposed by the PR. This repository implements the Stacks blockchain. Prioritize correctness, consensus safety, security, operational safety, and compatibility over general maintainability or style feedback. Path-specific guidance under `.github/instructions
No other project uses it yet
filecoin-projectCopilot instructionsfilecoin-project/lotus/.github/copilot-instructions.md
network-version gates and errors around tipsets, null rounds, deferred execution or reorgs. 2. Security and denial-of-service problems at RPC, gateway, chain-exchange and other untrusted-input boundaries
onetimesecretCopilot instructionsonetimesecret/onetimesecret/.github/copilot-instructions.md
scenario: a specific input or state leading to wrong output, data loss, or a security consequence. No scenario, no comment. Finding nothing that meets this bar is an acceptable review
MicrosoftCopilot instructionsmicrosoft/DirectXTK/.github/copilot-instructions.md
/walbourn/directxtktest/wiki). See [test copilot instructions](https://github.com/walbourn/directxtktest/blob/main/.github/copilot-instructions.md) for additional information on the tests. - **Security**: This project uses secure coding practices from the Microsoft Secure Coding Guidelines, and is subject
wireappCopilot instructionswireapp/wire-server/.github/copilot-instructions.md
/AGENTS.md) at the repository root for project overview, development environment, commands, quality expectations, and security guidelines
unpollerCopilot instructionsunpoller/unpoller/.github/copilot-instructions.md
Device Type Reporting Each output plugin has device-specific functions: - `UAP()` - Access Points - `USG()` - Security Gateways - `USW()` - Switches - `UDM()` - Dream Machines - `UXG()` - Next-Gen Gateways - `UBB()` - Building Bridges - `UCI()` - Industrial
No other project uses it yet
dvorkaCopilot instructionsdvorka/mindforger/.github/copilot-instructions.md
used as CI for Windows. - GitHub Actions CI configuration is stored under `.github/workflows/`. ## Security and secrets instructions - Always use environment variables and secret stores. - Always use GitHub actions secrets. - Never
intelCopilot instructionsintel/neural-compressor/.github/copilot-instructions.md
line length **120**. - Applies to all docs except `examples/`, `docs/source/JAX.md`, `neural_compressor/torch/algorithms/fp8_quant/`, and `test/torch/`. ## Security – bandit - All code under `neural_compressor/` must pass **bandit** at low severity
spiffeCopilot instructionsspiffe/spire/.github/copilot-instructions.md
more than one often applies to the same change: compatibility guarantees, SPIFFE spec conformance, security and usability, and project conventions. ## Review checklist These questions come from the SPIRE maintainer review
eventflowCopilot instructionseventflow/EventFlow/.github/copilot-instructions.md
GitHub management tools that mutate remote state (issues, pull requests, repositories, projects, workflows, labels, security alerts, notifications, etc.) unless the user has granted explicit permission in the current conversation. - Never
custom-cardsCopilot instructionscustom-cards/button-card/.github/copilot-instructions.md
ALWAYS build and test your changes: `npm run build` followed by manual validation - Security updates: `npm run audit-fix` - fixes known security vulnerabilities - CRITICAL VALIDATION: After making changes, ALWAYS test
No other project uses it yet
PSAppDeployToolkitCopilot instructionsPSAppDeployToolkit/PSAppDeployToolkit/.github/copilot-instructions.md
analyzer declares RuleCategories.Design. - Prefer CsWin32-generated friendly overloads (such as LsaGetLogonSessionData(in LUID, out SECURITY_LOGON_SESSION_DATA*)) over raw pointer overloads whenever available. - For internal record metadata types, prefer
No other project uses it yet
MicrosoftCopilot instructionsmicrosoft/Microsoft365DSC/.github/copilot-instructions.md
lazy about: input validation at trust boundaries, error handling that prevents data loss, security, accessibility, the calibration real hardware needs (the platform is never the spec ideal, a clock drifts
dotnetCopilot instructionsdotnet/iot/.github/copilot-instructions.md
System.Device.Pwm` where possible. - **Docs:** check `Documentation/` for contribution guidelines; keep wording and tone consistent. --- ## Security, licensing, and compliance - Code is under **MIT**; include appropriate headers where needed and avoid copying
OPCFoundationCopilot instructionsOPCFoundation/UA-.NETStandard/.github/copilot-instructions.md
assembly ` EventIds` conventions in [`docs/DeveloperGuide.md`](../docs/DeveloperGuide.md#add-a-log-message-source-generated). ### Security Requirements - **Never hardcode credentials, certificates, or secrets** in source code - **Certificate Management**: All certificates must be managed
Steady3 mentions in 2 weeks
No other project uses it yet
endurain-projectReads credentialsCopilot instructionsendurain-project/endurain/.github/copilot-instructions.md
Specialized coding standards and guidelines are in separate instruction files: - **Python/Backend:** `.github/instructions/python.instructions.md` - **TypeScript/JavaScript/Vue/Frontend:** `.github/instructions/javascript.instructions.md` - **Security (all files):** `.github/instructions/security-and-owasp.instructions.md` - **GitHub Actions / CI-CD:** `.github/instructions/github-actions-ci-cd-best-practices.instructions.md` - **Copilot Agents:** `.github/instructions/agents.instructions.md` - **Instruction files:** `.github/instructions/instructions.instructions.md` - **Prompt
Surging1 mention in 2 weeks
1 project uses a version of this
LiveHelperChatCopilot instructionsLiveHelperChat/livehelperchat/.github/copilot-instructions.md
svelte/store'; export const chats = writable([]); export const activeChat = derived(chats, $chats => $chats.find(c => c.selected) ); ``` # Security Considerations - Use `erLhcoreClassUser::instance()->hasAccessTo()` for permissions - Always validate API requests with `erLhcoreClassRestAPIHandler::validateRequest()` - Escape
kubeflowCopilot instructionskubeflow/trainer/.github/copilot-instructions.md
confusing" - stay silent unless HIGH confidence it will cause problems ## Priority Areas (Review These) ### Security & Safety - Unsafe code blocks without justification - Command injection risks (shell commands, user input) - Path traversal
Repository-wide instructions for GitHub Copilot, kept in .github/copilot-instructions.md.
How to build and test, the project's structure, and the conventions Copilot should follow in suggestions and reviews.
No. Copilot's coding agent also reads AGENTS.md, so many projects keep the shared rules there.
Open a file to see its discussion. Reports from people and their agents are coming.
