Adds Security Champion chat / agent mode to provide comprehensive security guidance by integrating Microsoft's Security Development Lifecycle (SDL) practices alongside existing OWASP frameworks. by obrocki · Pull Request #408 · microsoft/hve-core

obrocki · 2026-02-04T10:06:10Z

Incorporates all 10 Microsoft SDL practices for secure software development
Organizes security inspection areas by development lifecycle stage (Design, Code, Build/Deploy, Runtime)
Adds guidance for threat modeling, Zero Trust principles, and supply chain security
Expands responsibilities to include security design reviews and Secure by Design promotion
Maintains existing OWASP Top 10 and OWASP Top 10 for LLM Applications (2025) references

🔒 - Generated by Copilot

Pull Request

Description

Related Issue(s)

#416

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)

Sample Prompts and Usage

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)
Tests added for new functionality (if applicable)

AI Artifact Contributions

Used /prompt-analyze to review contribution
Addressed all feedback from prompt-builder review
Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

codecov-commenter · 2026-02-04T10:08:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.34%. Comparing base (adbebe1) to head (4071e05).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #408      +/-   ##
==========================================
- Coverage   85.36%   85.34%   -0.03%     
==========================================
  Files          23       23              
  Lines        4475     4475              
==========================================
- Hits         3820     3819       -1     
- Misses        655      656       +1

Flag	Coverage Δ
pester	`85.34% <ø> (-0.03%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR adds a Security Champion agent and comprehensive OWASP security instruction files to integrate Microsoft's Security Development Lifecycle (SDL) practices alongside existing OWASP frameworks. The PR introduces security guidance across the development lifecycle, from design through runtime, with detailed coding standards for both traditional web applications and LLM-specific security concerns.

Changes:

Adds Security Champion conversational agent for security-focused code review and advisory
Introduces comprehensive OWASP Top 10 secure coding instructions for web applications
Adds OWASP Top 10 for LLM Applications (2025) secure coding instructions for AI/ML security

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 14 comments.

File	Description
`.github/agents/security-champion.agent.md`	New conversational agent that serves as a security advisor, integrating Microsoft SDL practices with OWASP frameworks to guide security reviews across all development stages
`.github/instructions/owasp-for-web-applications.instructions.md`	New instruction file providing comprehensive secure coding guidelines based on OWASP Top 10, covering vulnerabilities from access control to SSRF
`.github/instructions/owasp-for-llms.instructions.md`	New instruction file providing LLM-specific security guidelines based on OWASP Top 10 for LLM Applications (2025), covering prompt injection, data leakage, and other AI-specific risks

.github/instructions/owasp-for-web-applications.instructions.md

.github/agents/security-champion.agent.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/security/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

.github/instructions/owasp-for-llms.instructions.md

.github/agents/security-champion.agent.md

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

.github/agents/security-champion.agent.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/agents/security-champion.agent.md

WilliamBerryiii · 2026-02-04T22:00:59Z

Hi! A small request: could you update the PR title to include the conventional commit format with scope? This ensures release-please picks it up correctly for the changelog.

Suggested: `feat(agents): add security champion agent with Microsoft SDL practices

Thanks!

katriendg

Thanks for your contribution. This is valuable, there are a few optimizations I feel are relevant before we merge.

Please re-run the /prompt-analyse or prompt-builder agent again and ensure you add your new files to the context, and ask it to review your three files for recommendations. There are several open recommendations you can still apply before we merge.
Evaluate the usage of the .instructions.md files and applyTo. Is it possible to merge into the custom agent instead? Especially for the LLM application instructions we do not want to enforce this upon every single edit of applicable files. Again here the Task-Researcher and/or Prompt Builder agents may help you refactor some of this in an efficient way.
## Required Phases given this agent has specific phases (in your case Stages), you should be able to easily reformat the agent to follow the phases approach. Also prompt-builder may do this for you.

Hope these make sense!

.github/agents/security-champion.agent.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/security/owasp-for-llms.instructions.md

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

.github/instructions/owasp-for-llms.instructions.md

.github/agents/security-champion.agent.md

.github/instructions/owasp-for-llms.instructions.md

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

katriendg · 2026-02-06T08:51:37Z

Thanks for your changes, I think this is looking good for an initial inclusion into experimental pre-release so we can have some active testing, see how it behaves when used together with some of the other instructions and agents.
Please review any open comments and close them, either adopt the recommendation or leave a note and close the comment. Some of the Copilot comments are valid, some you may just want to discard, or simply outdated.
Once all comments are closed I will do a final review and expect Approval soon from my side.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

.github/instructions/security/owasp-for-web-applications.instructions.md

.github/instructions/security/owasp-for-llms.instructions.md

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

.github/instructions/security/owasp-for-web-applications.instructions.md

.github/instructions/security/owasp-for-llms.instructions.md

.github/agents/security-champion.agent.md

.github/instructions/security/owasp-for-llms.instructions.md

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

.github/CUSTOM-AGENTS.md

…M applications - include OWASP Top 10 for LLM Applications (2025) security practices - outline responsibilities and areas to inspect during development stages - emphasize security champion mindset and ongoing threat awareness 🔒 - Generated by Copilot

…nd tools list 🔒 - Generated by Copilot

- clarify the directive for secure coding practices - emphasize the importance of a security-first mindset - enhance instructions for code reviews and security education 🔒 - Generated by Copilot

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…curity champion agent documentation 🔒 - Generated by Copilot

…hampion agent documentation 🔒 - Generated by Copilot

- enhance clarity and structure of security instructions - add maturity status to both documents - improve emphasis on security principles and practices - refine sections for better readability and understanding 🔒 - Generated by Copilot

… guidelines 🔒 - Generated by Copilot

…d guidance and handoffs - add security-focused code review purpose and workflow - include core frameworks and areas covered for security champion agent - remove maturity status from OWASP instructions for LLM and web applications 🔒 - Generated by Copilot

…arity and structure - redefine inspection areas as required phases - clarify flow through development lifecycle phases - enhance guidance for security reviews and reporting 🔒 - Generated by Copilot

- Remove tools frontmatter to let users choose available tools - Elaborate agent description for Extension UI visibility - Add #file: references for OWASP instructions so Copilot follows paths - Add maturity: experimental to both OWASP instruction files - Convert bolded-prefix list items to plain text in LLM instructions - Convert embedding inversion defense list to prose

…tore web applications guidelines - introduce OWASP Top 10 for LLM Applications with detailed security measures - restore comprehensive secure coding instructions for web applications - ensure clear communication of security practices and principles 🔒 - Generated by Copilot

…uctions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…uctions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

.github/agents/security-champion.agent.md

.github/instructions/security/owasp-for-web-applications.instructions.md

.github/instructions/security/owasp-for-llms.instructions.md

Copilot · 2026-02-13T17:01:51Z

.github/instructions/security/owasp-for-web-applications.instructions.md

@@ -0,0 +1,226 @@
+---
+description: "Comprehensive secure coding instructions for all languages and frameworks, based on OWASP Top 10 and industry best practices. Give clear and concise feedback and points of improvement."
+maturity: experimental


The frontmatter includes a maturity field, which is not allowed according to the instruction-frontmatter.schema.json schema. The schema defines additionalProperties: false and only allows description, name, and applyTo fields. Maturity is tracked in collection manifest items (collections/*.collection.yml), not in individual artifact frontmatter. Remove the maturity field from this frontmatter and instead add this file to an appropriate collection manifest with the maturity specified there.

Suggested change

maturity: experimental

Copilot · 2026-02-13T17:01:51Z

.github/instructions/security/owasp-for-llms.instructions.md

+---
+description: "When generating, reviewing, or refactoring code that interacts with Large Language Models (LLMs), read and follow these OWASP Top 10 for LLM Applications (2025) secure coding guidelines to protect against prompt injection, data leakage, and LLM-specific vulnerabilities. Apply these instructions to any LLM integration, agent framework, RAG pipeline, or AI-powered feature. Provide clear and concise security feedback and points of improvement."
+applyTo: '**/*'
+maturity: experimental


The frontmatter includes a maturity field, which is not allowed according to the instruction-frontmatter.schema.json schema. The schema defines additionalProperties: false and only allows description, name, and applyTo fields. Maturity is tracked in collection manifest items (collections/*.collection.yml), not in individual artifact frontmatter. Remove the maturity field from this frontmatter and instead add this file to an appropriate collection manifest with the maturity specified there.

Suggested change

maturity: experimental

…b applications and LLMs 🔒 - Generated by Copilot

Copilot AI review requested due to automatic review settings February 4, 2026 10:06

Copilot started reviewing on behalf of obrocki February 4, 2026 10:06 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 4, 2026 14:03

Copilot started reviewing on behalf of obrocki February 4, 2026 14:04 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 4, 2026 14:54

Copilot started reviewing on behalf of obrocki February 4, 2026 14:54 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

.github/instructions/owasp-for-llms.instructions.md Outdated Show resolved Hide resolved

.github/agents/security-champion.agent.md Show resolved Hide resolved

obrocki marked this pull request as ready for review February 4, 2026 16:24

obrocki requested a review from a team as a code owner February 4, 2026 16:24

Copilot AI review requested due to automatic review settings February 4, 2026 16:54

Copilot started reviewing on behalf of obrocki February 4, 2026 16:54 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

obrocki mentioned this pull request Feb 4, 2026

feat(agents): Add Security Champion agent with SDL and OWASP guidance #416

Open

WilliamBerryiii reviewed Feb 4, 2026

View reviewed changes

.github/agents/security-champion.agent.md Outdated Show resolved Hide resolved

WilliamBerryiii reviewed Feb 4, 2026

View reviewed changes

.github/agents/security-champion.agent.md Outdated Show resolved Hide resolved

WilliamBerryiii added this to the v2.2.0 milestone Feb 5, 2026

katriendg requested changes Feb 5, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 5, 2026 14:52

Copilot started reviewing on behalf of obrocki February 5, 2026 14:52 View session

Copilot AI reviewed Feb 5, 2026

View reviewed changes

.github/instructions/owasp-for-llms.instructions.md Outdated Show resolved Hide resolved

.github/agents/security-champion.agent.md Show resolved Hide resolved

.github/instructions/owasp-for-llms.instructions.md Outdated Show resolved Hide resolved

Copilot AI review requested due to automatic review settings February 5, 2026 19:48

Copilot started reviewing on behalf of obrocki February 5, 2026 19:49 View session

obrocki requested a review from katriendg February 5, 2026 19:49

Copilot AI reviewed Feb 5, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 6, 2026 13:28

Copilot started reviewing on behalf of obrocki February 13, 2026 13:23 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

.github/instructions/security/owasp-for-web-applications.instructions.md Show resolved Hide resolved

.github/instructions/security/owasp-for-web-applications.instructions.md Show resolved Hide resolved

.github/instructions/security/owasp-for-llms.instructions.md Show resolved Hide resolved

Copilot AI review requested due to automatic review settings February 13, 2026 13:53

Copilot started reviewing on behalf of obrocki February 13, 2026 13:53 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 13, 2026 16:16

Copilot started reviewing on behalf of obrocki February 13, 2026 16:17 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

.github/CUSTOM-AGENTS.md Show resolved Hide resolved

obrocki and others added 15 commits February 13, 2026 16:56

feat(security-identity): update Security Champion agent description a…

deaf261

…nd tools list 🔒 - Generated by Copilot

docs(instructions): refine secure coding guidelines for LLM applications

cdb3856

- clarify the directive for secure coding practices - emphasize the importance of a security-first mindset - enhance instructions for code reviews and security education 🔒 - Generated by Copilot

Update .github/instructions/owasp-for-web-applications.instructions.md

7d53070

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

style(security-identity): fix link formatting for Microsoft SDL in se…

bb77c14

…curity champion agent documentation 🔒 - Generated by Copilot

style(security-identity): refine language and structure in security c…

88cf9b5

…hampion agent documentation 🔒 - Generated by Copilot

chore(instructions): update maturity status to experimental for OWASP…

211597a

… guidelines 🔒 - Generated by Copilot

feat(security-identity): update security champion agent phases for cl…

b650ad8

…arity and structure - redefine inspection areas as required phases - clarify flow through development lifecycle phases - enhance guidance for security reviews and reporting 🔒 - Generated by Copilot

Update .github/instructions/security/owasp-for-web-applications.instr…

5492b4d

…uctions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update .github/instructions/security/owasp-for-llms.instructions.md

b7f9260

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update .github/instructions/security/owasp-for-web-applications.instr…

c8e2456

…uctions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 13, 2026 16:56

obrocki force-pushed the feat/security-champion-agent branch from 673ade6 to c8e2456 Compare February 13, 2026 16:56

Copilot started reviewing on behalf of obrocki February 13, 2026 16:57 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

WilliamBerryiii modified the milestones: v2.3.0, v2.4.0 Feb 13, 2026

feat(instructions): add experimental OWASP security guidelines for we…

4071e05

…b applications and LLMs 🔒 - Generated by Copilot

Conversation

obrocki commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Description

Related Issue(s)

Type of Change

Sample Prompts and Usage

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

codecov-commenter commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

WilliamBerryiii commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

katriendg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

obrocki commented Feb 4, 2026 •

edited

Loading

codecov-commenter commented Feb 4, 2026 •

edited

Loading

WilliamBerryiii commented Feb 4, 2026 •

edited

Loading