Skip to content

Conversation

@obrocki
Copy link

@obrocki obrocki commented Feb 4, 2026

  • Incorporates all 10 Microsoft SDL practices for secure software development
  • Organizes security inspection areas by development lifecycle stage (Design, Code, Build/Deploy, Runtime)
  • Adds guidance for threat modeling, Zero Trust principles, and supply chain security
  • Expands responsibilities to include security design reviews and Secure by Design promotion
  • Maintains existing OWASP Top 10 and OWASP Top 10 for LLM Applications (2025) references

🔒 - Generated by Copilot

Pull Request

Description

Related Issue(s)

#416

Type of Change

Select all that apply:

Code & Documentation:

  • Bug fix (non-breaking change fixing an issue)
  • New feature (non-breaking change adding functionality)
  • Breaking change (fix or feature causing existing functionality to change)
  • Documentation update

Infrastructure & Configuration:

  • GitHub Actions workflow
  • Linting configuration (markdown, PowerShell, etc.)
  • Security configuration
  • DevContainer configuration
  • Dependency update

AI Artifacts:

  • Reviewed contribution with prompt-builder agent and addressed all feedback
  • Copilot instructions (.github/instructions/*.instructions.md)
  • Copilot prompt (.github/prompts/*.prompt.md)
  • Copilot agent (.github/agents/*.agent.md)

Sample Prompts and Usage

image

Checklist

Required Checks

  • Documentation is updated (if applicable)
  • Files follow existing naming conventions
  • Changes are backwards compatible (if applicable)
  • Tests added for new functionality (if applicable)

AI Artifact Contributions

  • Used /prompt-analyze to review contribution
  • Addressed all feedback from prompt-builder review
  • Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

  • Markdown linting: npm run lint:md
  • Spell checking: npm run spell-check
  • Frontmatter validation: npm run lint:frontmatter
  • Link validation: npm run lint:md-links
  • PowerShell analysis: npm run lint:ps

Security Considerations

  • This PR does not contain any sensitive or NDA information
  • Any new dependencies have been reviewed for security issues
  • Security-related scripts follow the principle of least privilege

Additional Notes

…M applications

- include OWASP Top 10 for LLM Applications (2025) security practices
- outline responsibilities and areas to inspect during development stages
- emphasize security champion mindset and ongoing threat awareness

🔒 - Generated by Copilot
Copilot AI review requested due to automatic review settings February 4, 2026 10:06
@codecov-commenter
Copy link

codecov-commenter commented Feb 4, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.19%. Comparing base (2b4d123) to head (c0d6bde).

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #408      +/-   ##
==========================================
- Coverage   76.22%   76.19%   -0.03%     
==========================================
  Files          20       20              
  Lines        3503     3503              
==========================================
- Hits         2670     2669       -1     
- Misses        833      834       +1     
Flag Coverage Δ
pester 76.19% <ø> (-0.03%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds a Security Champion agent and comprehensive OWASP security instruction files to integrate Microsoft's Security Development Lifecycle (SDL) practices alongside existing OWASP frameworks. The PR introduces security guidance across the development lifecycle, from design through runtime, with detailed coding standards for both traditional web applications and LLM-specific security concerns.

Changes:

  • Adds Security Champion conversational agent for security-focused code review and advisory
  • Introduces comprehensive OWASP Top 10 secure coding instructions for web applications
  • Adds OWASP Top 10 for LLM Applications (2025) secure coding instructions for AI/ML security

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 14 comments.

File Description
.github/agents/security-champion.agent.md New conversational agent that serves as a security advisor, integrating Microsoft SDL practices with OWASP frameworks to guide security reviews across all development stages
.github/instructions/owasp-for-web-applications.instructions.md New instruction file providing comprehensive secure coding guidelines based on OWASP Top 10, covering vulnerabilities from access control to SSRF
.github/instructions/owasp-for-llms.instructions.md New instruction file providing LLM-specific security guidelines based on OWASP Top 10 for LLM Applications (2025), covering prompt injection, data leakage, and other AI-specific risks

obrocki and others added 2 commits February 4, 2026 13:25
- clarify the directive for secure coding practices
- emphasize the importance of a security-first mindset
- enhance instructions for code reviews and security education

🔒 - Generated by Copilot
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings February 4, 2026 14:03
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

Copilot AI review requested due to automatic review settings February 4, 2026 14:54
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

@obrocki obrocki marked this pull request as ready for review February 4, 2026 16:24
@obrocki obrocki requested a review from a team as a code owner February 4, 2026 16:24
…hampion agent documentation

🔒 - Generated by Copilot
- enhance clarity and structure of security instructions
- add maturity status to both documents
- improve emphasis on security principles and practices
- refine sections for better readability and understanding

🔒 - Generated by Copilot
Copilot AI review requested due to automatic review settings February 4, 2026 16:54
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

description: "🔐 Security Champion"
tools: ['execute/getTerminalOutput', 'read', 'agent', 'todo']
argument-hint: "Assist development teams in integrating security best practices throughout the software development lifecycle by acting as a Security Champion."
maturity: preview
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

might want to make this as experimental for now.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair. Been using it out in the wild so it has a bit of mileage already.


These frameworks apply throughout the development lifecycle:

* [OWASP Top 10](../instructions/owasp-for-web-applications.instructions.md) for web application security
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@katriendg & @agreaves-ms - I'm of the option that in order to get comprehensive review across all these areas, we need to use the same pattern as task researcher where we have a orchestration agent and then sub-agents for each of the areas of focus ... adding in mitre, soc, etc. as dedicated subagents that deeply understand the domain of each standard/practice. thoughts?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fully agreed, now with the latest release running parallel subagents is supported: https://code.visualstudio.com/updates/v1_109#_agent-orchestration

I wonder if some of the current instructions files referenced by the agent can be transformed by integrating into a more planned approach of going through stages or phases as subagents that are called within the main orchestrator (this security champion agent).

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to start with an MVP version of the discussed capability and add an Issue that captures evolution of this?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a good idea, though there are some quick wins you may be able to get for this initial MVP. I'll be adding a few PR comments around these. Thanks.

@WilliamBerryiii
Copy link
Member

WilliamBerryiii commented Feb 4, 2026

Hi! A small request: could you update the PR title to include the conventional commit format with scope? This ensures release-please picks it up correctly for the changelog.

Suggested: `feat(agents): add security champion agent with Microsoft SDL practices

Thanks!

@WilliamBerryiii WilliamBerryiii added this to the v2.2.0 milestone Feb 5, 2026
Copy link
Contributor

@katriendg katriendg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your contribution. This is valuable, there are a few optimizations I feel are relevant before we merge.

  1. Please re-run the /prompt-analyse or prompt-builder agent again and ensure you add your new files to the context, and ask it to review your three files for recommendations. There are several open recommendations you can still apply before we merge.
  2. Evaluate the usage of the .instructions.md files and applyTo. Is it possible to merge into the custom agent instead? Especially for the LLM application instructions we do not want to enforce this upon every single edit of applicable files. Again here the Task-Researcher and/or Prompt Builder agents may help you refactor some of this in an efficient way.
  3. ## Required Phases given this agent has specific phases (in your case Stages), you should be able to easily reformat the agent to follow the phases approach. Also prompt-builder may do this for you.

Hope these make sense!

@@ -0,0 +1,83 @@
---
description: "🔐 Security Champion"
tools: ['execute/getTerminalOutput', 'read', 'agent', 'todo']
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add fetch_webpage or remove the tools entirely as your agent has external references it won't be able to fetch. I lately see more value in removing the tools entirely so that users can choose which tools they want to allow.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see the point of leaving tools blank, would that be the best out-of-the-box, ready-to-go experience?


These frameworks apply throughout the development lifecycle:

* [OWASP Top 10](../instructions/owasp-for-web-applications.instructions.md) for web application security
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a good idea, though there are some quick wins you may be able to get for this initial MVP. I'll be adding a few PR comments around these. Thanks.


## Security Champion Mindset

Security is an ongoing effort where threats, technology, and business assets constantly evolve. Help teams understand the attacker's perspective and goals. Focus on practical, real-world security wins rather than theoretical overkill. Treat threat modeling as a fundamental engineering skill that all developers should possess.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add the footer as documented in docs/contributing/custom-agents.md

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I missed that one, thank you for pointing it out!

@@ -0,0 +1,83 @@
---
description: "🔐 Security Champion"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The description needs to be more elaborated, when we include this in the Extension packaging it will pick up that description automatically and show it in some of the UI.

description: "🔐 Security Champion"
tools: ['execute/getTerminalOutput', 'read', 'agent', 'todo']
argument-hint: "Assist development teams in integrating security best practices throughout the software development lifecycle by acting as a Security Champion."
maturity: experimental
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you evaluated how this agent can handoff to security-plan-creator?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not yet, keeping it focused and small for now, good suggestion tho!


These frameworks apply throughout the development lifecycle:

* [OWASP Top 10](../instructions/owasp-for-web-applications.instructions.md) for web application security
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: consider adding #file: so copilot can follow the path, same for the next line

@@ -0,0 +1,573 @@
---
description: "Comprehensive secure coding instructions for LLM applications based on OWASP Top 10 for LLM Applications (2025). Ensures AI-powered systems are secure by default, protecting against prompt injection, data leakage, and LLM-specific vulnerabilities. Give clear and concise feedback and points of improvement."
applyTo: '**/*.py, **/*.tsx, **/*.ts, **/*.jsx, **/*.js, **/*.cs, **/*.java'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Highly recommend rethinking the applyTo which will be added to the context on every single context when files with these extensions are active. This seems inefficient since a lot of work users will do are not relevant to LLM applications guidance. I recommend removing the applyTo entirely, and leaving to being called by the agent instead.

@@ -0,0 +1,226 @@
---
description: "Comprehensive secure coding instructions for all languages and frameworks, based on OWASP Top 10 and industry best practices. Give clear and concise feedback and points of improvement."
applyTo: '**/*.py, **/*.tsx, **/*.ts, **/*.jsx, **/*.js'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, are we sure we want to push this instruction to every edit of a file with these extensions?


Separate system instructions from user content using clear delimiters. Do not concatenate user input directly into prompts without sanitization.

```python
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Get prompt builder to help you reformat all examples such as these with XML blocks as per convention. Something like the following, emoji up to you to decide.

<!-- <example-prompt-injection-defense> -->
```python
# ✅ GOOD: Structured prompt with clear boundaries
system_prompt = "You are a customer service assistant. Only answer questions about product features."
user_input = sanitize_input(request.user_message)  # Remove injection attempts
response = llm.generate(system=system_prompt, user=user_input)
validated_response = validate_output_schema(response)  # Ensure format compliance
# ❌ BAD: Direct concatenation with no validation
prompt = f"Answer this: {request.user_message}"  # Vulnerable to injection
response = llm.generate(prompt)  # No output validation

Copilot AI review requested due to automatic review settings February 5, 2026 14:52
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

obrocki and others added 2 commits February 5, 2026 19:33
…arity and structure

- redefine inspection areas as required phases
- clarify flow through development lifecycle phases
- enhance guidance for security reviews and reporting

🔒 - Generated by Copilot
Copilot AI review requested due to automatic review settings February 5, 2026 19:48
@obrocki obrocki requested a review from katriendg February 5, 2026 19:49
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

@katriendg
Copy link
Contributor

Thanks for your changes, I think this is looking good for an initial inclusion into experimental pre-release so we can have some active testing, see how it behaves when used together with some of the other instructions and agents.
Please review any open comments and close them, either adopt the recommendation or leave a note and close the comment. Some of the Copilot comments are valid, some you may just want to discard, or simply outdated.
Once all comments are closed I will do a final review and expect Approval soon from my side.

- Remove tools frontmatter to let users choose available tools
- Elaborate agent description for Extension UI visibility
- Add #file: references for OWASP instructions so Copilot follows paths
- Add maturity: experimental to both OWASP instruction files
- Convert bolded-prefix list items to plain text in LLM instructions
- Convert embedding inversion defense list to prose
Copilot AI review requested due to automatic review settings February 6, 2026 13:28
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

@obrocki
Copy link
Author

obrocki commented Feb 6, 2026

Thanks for your changes, I think this is looking good for an initial inclusion into experimental pre-release so we can have some active testing, see how it behaves when used together with some of the other instructions and agents.
Please review any open comments and close them, either adopt the recommendation or leave a note and close the comment. Some of the Copilot comments are valid, some you may just want to discard, or simply outdated.
Once all comments are closed I will do a final review and expect Approval soon from my side.

Thank you for your feedback and help!

@@ -0,0 +1,568 @@
---
description: "Comprehensive secure coding instructions for LLM applications based on OWASP Top 10 for LLM Applications (2025). Ensures AI-powered systems are secure by default, protecting against prompt injection, data leakage, and LLM-specific vulnerabilities. Give clear and concise feedback and points of improvement."
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The description for instructions.md files are added to the system message for the conversation context. I recommend treating all descriptions as additional instructions, so changing this description to inform the model of when to read and use these instructions files.

maturity: experimental
---

# OWASP Top 10 for LLM Applications - Secure Coding Guidelines
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like it's meant to be used for developing an agentic platform that orchestrates LLMs together for different business use-cases.

I recommend moving both of these instructions into a subfolder, such as llm-platform or whatever a better name might be.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about security? One of them has nothing to do with LLMs...


#### Red Team Testing

Before deploying any third-party model, conduct rigorous adversarial testing including prompt injection attempts, jailbreaking tests, and bias evaluation.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I recommend reviewing all of the lines in this instructions file and consider what would make sense as an actual instruction to Claude or GPT. As an example, this instruction is not clear with what the model should do. Should it tell the user this information? If so, how would it present this information to the user?


## Instructions

Ensure all code generated, reviewed, or refactored is secure by default. Operate with a security-first mindset. When in doubt, choose the more secure option and explain the reasoning.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same thing here, I would recommend moving this into a different folder, owasp maybe

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both instructions are based on owasp security recommedataions 👇
#408 (comment)


#### Principle of Least Privilege

Default to the most restrictive permissions. Explicitly verify the caller's rights for each protected resource or action.
Copy link
Contributor

@agreaves-ms agreaves-ms Feb 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same for this instructions file, I would recommend reviewing each individual line and make sure it makes sense as an instruction for the model to follow. As an example, the model may not know what the most restrictive permissions are and can result in unintended outputs, same thing for explicitly verifying the caller's rights and what would be considered a protected resource or action.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the agent and instructions are in preveiw / experimantal state I'd like to gather more field feedback before revisiting the prompts.

@WilliamBerryiii WilliamBerryiii modified the milestones: v2.2.0, v2.3.0 Feb 6, 2026
WilliamBerryiii and others added 2 commits February 7, 2026 15:25
…tore web applications guidelines

- introduce OWASP Top 10 for LLM Applications with detailed security measures
- restore comprehensive secure coding instructions for web applications
- ensure clear communication of security practices and principles

🔒 - Generated by Copilot
Copilot AI review requested due to automatic review settings February 9, 2026 11:16
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants