From f83e927bafd1f0a1aeb7b2e7dadf48ad560a6ee1 Mon Sep 17 00:00:00 2001 From: Cristiano Betta Date: Fri, 23 Oct 2026 16:30:19 +0100 Subject: [PATCH] Add Copilot review instructions Co-Authored-By: Claude Sonnet 5.5 --- .github/copilot-instructions.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/copilot-instructions.md diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md new file mode 100644 index 0000000..5a7863c --- /dev/null +++ b/.github/copilot-instructions.md @@ -0,0 +1,14 @@ +# Copilot code review instructions + +Report only correctness, security, data-loss and permission problems. Skip style, naming, comment wording, formatting and test structure. Don't repeat a point that was already declined with a reason in the PR. If a finding wouldn't cause a bug or a leak, don't post it. Prefer one precise comment with the failing input over several general ones. + +## Security checklist + +Flag any of these: + +- Secrets or tokens in logs, error messages or commits. +- Text written by other people (mail, messages, web pages) reaching a model unwrapped. mcp-hub wraps it in ``. +- One account's data reaching another account (the agents dashboard is multi-account). +- Personal data (mail, messages, health) in logs or error messages. +- A new route or action with no permission check. +- Workflow changes that give a branch or fork access to secrets (`pull_request_target`, broader `permissions`, secrets passed to unreviewed code).