GitHub Copilot Custom Instructions and Risks
Brief
GitHub Copilot has the capability to be augmented with custom instructions coming from the current repo, via the . github/copilot-instructions. md file.
Pillar Security recently highlighted the risks associated with rules files. Their post discusses custom Cursor rules in . /cursor/rules ending in . mdc .
If you watch the demos, you’ll notice that they also have a GitHub Copilot demo which uses the GitHub specific copilot-instructions.md file.
Update: May 1, 2025 GitHub made a product change and is now highlighting invisible Unicode characters in the Web UI. In their announcement GitHub is referencing the Pillar Security post and also my post about ASCII Smuggling. Very cool!