> GitHub Copilot Custom Instructions and Risks

GitHub Copilot has the capability to be augmented with custom instructions coming from the current repo, via the .github/copilot-instructions.md file. Pillar Security recently highlighted the risks associated with rules files. Their post discusses custom Cursor rules in ./cursor/rules ending in .mdc. If you watch the demos, you’ll notice that they also have a GitHub Copilot demo which uses the GitHub specific copilot-instructions.md file. Update: May 1, 2025 GitHub made a product change and is now highlighting invisible Unicode characters in the Web UI.