How real projects brief GitHub Copilot, from .github/copilot-instructions.md.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
freeCodeCampCopilot instructionsfreeCodeCamp/freeCodeCamp/.github/copilot-instructions.md
actionable ### Prioritization When multiple issues exist, address them in order of severity: 1. Security vulnerabilities or critical bugs 2. Missing test coverage for new functionality 3. Outdated tests for modified
No other project uses it yet
affaan-mCopilot instructionsaffaan-m/ECC/.github/copilot-instructions.md
test before the implementation; target 80%+ coverage. 4. **Review before committing** — check for security issues, code quality, and regressions. 5. **Conventional commits** — `feat`, `fix`, `refactor`, `docs`, `test`, `chore`, `perf
Steady32 mentions in 2 weeks
2 projects use a version of this
Significant-GravitasReads credentialsCopilot instructionsSignificant-Gravitas/AutoGPT/.github/copilot-instructions.md
dependencies and scripts - `schema.prisma` - Database schema and migrations - `next.config.mjs` - Next.js configuration - `tailwind.config.ts` - Styling configuration ### Security & Middleware **Cache Protection**: Backend includes middleware preventing sensitive data caching in browsers/proxies **Authentication**: JWT-based
Steady3 mentions in 2 weeks
No other project uses it yet
DietrichGebertCopilot instructionsDietrichGebert/ponytail/.github/copilot-instructions.md
unfinished: new non-trivial logic (a branch, a loop, a parser, money or security, or a whole new script or app) leaves one small test or an assert-based self
Steady11 mentions in 2 weeks
No other project uses it yet
MicrosoftCopilot instructionsmicrosoft/PowerToys/.github/copilot-instructions.md
PowerToys AI contributor guidance
SupabaseCopilot instructionssupabase/supabase/.github/copilot-instructions.md
Threshold Only comment when you are **>85% confident** the issue is a real bug, security vulnerability, or logic error. If you are unsure, do not comment. Silence is better than
Steady6 mentions in 2 weeks
No other project uses it yet
axiosCopilot instructionsaxios/axios/.github/copilot-instructions.md
boundaries, naming, error handling, interceptor order, the request lifecycle, cancellation, common pitfalls, tests, and security-sensitive code. The rules below are a Copilot-facing subset of the load-bearing safety
No other project uses it yet
denolandCopilot instructionsdenoland/deno/.github/copilot-instructions.md
derefs 2. **Public API leaks** — internal fields accidentally exposed in public return types 3. **Security** — unsafe blocks with incorrect safety invariants, unsanitized inputs at system boundaries 4. **Missing error handling
No other project uses it yet
MicrosoftCopilot instructionsmicrosoft/playwright/.github/copilot-instructions.md
Guidelines When reviewing pull requests: - Only comment on semantically meaningful issues: bugs, incorrect logic, security problems, or API contract violations. - Skip style, formatting, naming, and whitespace observations unless they cause
No other project uses it yet
home-assistantPipes a download into a shellCopilot instructionshome-assistant/core/.github/copilot-instructions.md
executed at runtime. - Sensitive service actions, i.e. those that can change configuration or have security implications, should require an admin user. Register them with the `async_register_admin_service` service
No other project uses it yet
chopratejasCopilot instructionschopratejas/headroom/.github/copilot-instructions.md
text should be called out. 4. For user-facing, release, dependency, workflow, or security-sensitive changes, prefer blocking feedback over optional suggestions. 5. Focus on correctness, safety, and whether
2 projects use a version of this
tesseract-ocrDeletes or force-pushesCopilot instructionstesseract-ocr/tesseract/.github/copilot-instructions.md
Autotools builds, comprehensive testing 3. **unittest.yml** - Unit tests with sanitizers (ASAN, UBSAN) 4. **codeql-analysis.yml** - Security static analysis 5. **vcpkg.yml**, **msys2.yml**, **cmake-win64.yml** - Windows builds ### Validation Requirements All PRs trigger: - **Build tests
1 project uses a version of this
mobyCopilot instructionsmoby/moby/.github/copilot-instructions.md
dependency bump message. Inspect the actual diff and describe the likely behavioral, build, test, security, and compatibility impact. - For changes that appear mechanical, check whether they affect daemon behavior, client
No other project uses it yet
BlockCopilot instructionsblock/goose/.github/copilot-instructions.md
confusing" - stay silent unless HIGH confidence it will cause problems ## Priority Areas (Review These) ### Security & Safety - Unsafe code blocks without justification - Command injection risks (shell commands, user input) - Path traversal
1 project uses a version of this
metabaseCopilot instructionsmetabase/metabase/.github/copilot-instructions.md
conventions, see `AGENTS.md` and the skills in `.claude/skills/`. ## Code Review Standards Review focus areas: Security → Performance → Testing → Documentation (in priority order) When reviewing code, use these emoji prefixes to categorize
acmesh-officialCopilot instructionsacmesh-official/acme.sh/.github/copilot-instructions.md
acme.sh](https://github.com/acmesh-official/acme.sh) project. Ensure the code exhibits the highest levels of robustness, security, and portability. The review must focus on risks unique to Shell scripting, such as proper
No other project uses it yet
streamlitCopilot instructionsstreamlit/streamlit/.github/copilot-instructions.md
clear error, a short doc note, or leaving the code as is. Security issues and data loss still need a real fix. This applies to review feedback too: a reviewer
amruthpillaiCopilot instructionsamruthpillai/reactive-resume/.github/copilot-instructions.md
full|wenyan-ultra Stop: "stop caveman" or "normal mode" Auto-Clarity: drop caveman for security warnings, irreversible actions, user confused. Resume after. Boundaries: code/commits/PRs written normal
2 projects use a version of this
ToolJetCopilot instructionsToolJet/ToolJet/.github/copilot-instructions.md
Lucide React (`lucide-react`). Do NOT add new icon packages. - Static assets: `frontend/assets/images/`. ## Security - No API keys/secrets in client-side code. - Backend: parameterized queries only, never concatenate user input into
Steady5 mentions in 2 weeks
No other project uses it yet
photoprismReads credentialsCopilot instructionsphotoprism/photoprism/.github/copilot-instructions.md
Setup: https://docs.photoprism.app/developer-guide/setup/ - Developer Guide – Tests: https://docs.photoprism.app/developer-guide/tests/ - Contributing: https://github.com/photoprism/photoprism/blob/develop/CONTRIBUTING.md - Security: https://github.com/photoprism/photoprism/blob/develop/SECURITY.md - REST API (Swagger): https://docs.photoprism.dev/ - REST API Guide: https://docs.photoprism.app/developer-guide/api/ - Agents
No other project uses it yet
Repository-wide instructions for GitHub Copilot, kept in .github/copilot-instructions.md.
How to build and test, the project's structure, and the conventions Copilot should follow in suggestions and reviews.
No. Copilot's coding agent also reads AGENTS.md, so many projects keep the shared rules there.
Open a file to see its discussion. Reports from people and their agents are coming.
