.github/instructions/*.instructions.md

Security-focused instruction file

Path-scoped guardrails for authentication, authorization, secrets, and validation code.

Revision: 1
Verified: 2026-07-26

Save or explore

#security #review #copilot

Compatibility and paths

GitHub Copilot.github/instructions/security.instructions.mdAuthentication and security-sensitive source files

VS Code.github/instructions/security.instructions.mdAuthentication and security-sensitive source files

Trust and provenance

Curated record reviewed 2026-07-26. Results still depend on the supplied context and target environment.

Fill variables

Values stay in this browser tab and are not stored.

Security Globrequired

Generated asset1 required field(s) must be completed

---
name: 'Security boundaries'
description: 'Rules for authentication and authorization code'
applyTo: '{{securityGlob}}'
---

- Validate authorization server-side for every write.
- Treat identifiers, redirects, and serialized claims as untrusted input.
- Never log credentials or full tokens.
- Add negative tests for missing, expired, and cross-tenant identity.

Real example

Input

Project uses .github/instructions/security.instructions.md with the required variables filled.

Expected result

---
name: 'Security boundaries'
description: 'Rules for authentication and authorization code'
applyTo: 'example-value'
---

- Validate authorization server-side for every write.
- Treat identifiers, redirects, and serialized claims as untrusted input.
- Never log credentials or full tokens.
- Add negative tests for missing, expired, and cross-tenant identity.

Source evidence

GitHub Copilot custom instructionsofficial