Adds Security Champion chat / agent mode to provide comprehensive security guidance by integrating Microsoft's Security Development Lifecycle (SDL) practices alongside existing OWASP frameworks. #408

obrocki · 2026-02-04T10:06:10Z

Incorporates all 10 Microsoft SDL practices for secure software development
Organizes security inspection areas by development lifecycle stage (Design, Code, Build/Deploy, Runtime)
Adds guidance for threat modeling, Zero Trust principles, and supply chain security
Expands responsibilities to include security design reviews and Secure by Design promotion
Maintains existing OWASP Top 10 and OWASP Top 10 for LLM Applications (2025) references

🔒 - Generated by Copilot

Pull Request

Description

Related Issue(s)

#416

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)

Sample Prompts and Usage

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)
Tests added for new functionality (if applicable)

AI Artifact Contributions

Used /prompt-analyze to review contribution
Addressed all feedback from prompt-builder review
Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

…M applications - include OWASP Top 10 for LLM Applications (2025) security practices - outline responsibilities and areas to inspect during development stages - emphasize security champion mindset and ongoing threat awareness 🔒 - Generated by Copilot

codecov-commenter · 2026-02-04T10:08:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.39%. Comparing base (7927db2) to head (d698f0b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #408      +/-   ##
==========================================
- Coverage   83.41%   83.39%   -0.03%     
==========================================
  Files          20       20              
  Lines        3510     3510              
==========================================
- Hits         2928     2927       -1     
- Misses        582      583       +1

Flag	Coverage Δ
pester	`83.39% <ø> (-0.03%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…nd tools list 🔒 - Generated by Copilot

Copilot

Pull request overview

This PR adds a Security Champion agent and comprehensive OWASP security instruction files to integrate Microsoft's Security Development Lifecycle (SDL) practices alongside existing OWASP frameworks. The PR introduces security guidance across the development lifecycle, from design through runtime, with detailed coding standards for both traditional web applications and LLM-specific security concerns.

Changes:

Adds Security Champion conversational agent for security-focused code review and advisory
Introduces comprehensive OWASP Top 10 secure coding instructions for web applications
Adds OWASP Top 10 for LLM Applications (2025) secure coding instructions for AI/ML security

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 14 comments.

File	Description
`.github/agents/security-champion.agent.md`	New conversational agent that serves as a security advisor, integrating Microsoft SDL practices with OWASP frameworks to guide security reviews across all development stages
`.github/instructions/owasp-for-web-applications.instructions.md`	New instruction file providing comprehensive secure coding guidelines based on OWASP Top 10, covering vulnerabilities from access control to SSRF
`.github/instructions/owasp-for-llms.instructions.md`	New instruction file providing LLM-specific security guidelines based on OWASP Top 10 for LLM Applications (2025), covering prompt injection, data leakage, and other AI-specific risks

.github/instructions/owasp-for-web-applications.instructions.md

.github/agents/security-champion.agent.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/security/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

- clarify the directive for secure coding practices - emphasize the importance of a security-first mindset - enhance instructions for code reviews and security education 🔒 - Generated by Copilot

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

…curity champion agent documentation 🔒 - Generated by Copilot

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

.github/instructions/owasp-for-llms.instructions.md

.github/agents/security-champion.agent.md

…hampion agent documentation 🔒 - Generated by Copilot

- enhance clarity and structure of security instructions - add maturity status to both documents - improve emphasis on security principles and practices - refine sections for better readability and understanding 🔒 - Generated by Copilot

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

.github/agents/security-champion.agent.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/agents/security-champion.agent.md

WilliamBerryiii · 2026-02-04T22:00:59Z

Hi! A small request: could you update the PR title to include the conventional commit format with scope? This ensures release-please picks it up correctly for the changelog.

Suggested: `feat(agents): add security champion agent with Microsoft SDL practices

Thanks!

… guidelines 🔒 - Generated by Copilot

katriendg

Thanks for your contribution. This is valuable, there are a few optimizations I feel are relevant before we merge.

Please re-run the /prompt-analyse or prompt-builder agent again and ensure you add your new files to the context, and ask it to review your three files for recommendations. There are several open recommendations you can still apply before we merge.
Evaluate the usage of the .instructions.md files and applyTo. Is it possible to merge into the custom agent instead? Especially for the LLM application instructions we do not want to enforce this upon every single edit of applicable files. Again here the Task-Researcher and/or Prompt Builder agents may help you refactor some of this in an efficient way.
## Required Phases given this agent has specific phases (in your case Stages), you should be able to easily reformat the agent to follow the phases approach. Also prompt-builder may do this for you.

Hope these make sense!

.github/agents/security-champion.agent.md

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/owasp-for-web-applications.instructions.md

.github/instructions/security/owasp-for-llms.instructions.md

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

.github/instructions/security/owasp-for-web-applications.instructions.md

obrocki · 2026-02-06T13:35:18Z

Thanks for your changes, I think this is looking good for an initial inclusion into experimental pre-release so we can have some active testing, see how it behaves when used together with some of the other instructions and agents.
Please review any open comments and close them, either adopt the recommendation or leave a note and close the comment. Some of the Copilot comments are valid, some you may just want to discard, or simply outdated.
Once all comments are closed I will do a final review and expect Approval soon from my side.

Thank you for your feedback and help!

.github/instructions/owasp-for-llms.instructions.md

.github/instructions/security/owasp-for-llms.instructions.md

.github/instructions/security/owasp-for-web-applications.instructions.md

…tore web applications guidelines - introduce OWASP Top 10 for LLM Applications with detailed security measures - restore comprehensive secure coding instructions for web applications - ensure clear communication of security practices and principles 🔒 - Generated by Copilot

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

.github/instructions/security/owasp-for-web-applications.instructions.md

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

.github/instructions/security/owasp-for-web-applications.instructions.md

…uctions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

.github/instructions/security/owasp-for-web-applications.instructions.md

.github/instructions/security/owasp-for-llms.instructions.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…uctions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

Copilot · 2026-02-13T13:56:48Z

.github/instructions/security/owasp-for-web-applications.instructions.md

+// GOOD: Load from environment or secret store
+const apiKey = process.env.API_KEY; 
+// TODO: Ensure API_KEY is securely configured in your environment.


This TypeScript example line has trailing whitespace after the semicolon. It’s minor, but it can cause noisy diffs and formatting churn in copied examples. Remove the trailing spaces in the snippet.

Copilot · 2026-02-13T13:56:48Z

.github/instructions/security/owasp-for-llms.instructions.md

+
+// ❌ BAD: Direct exposure of sensitive data
+const prompt = `Analyze this customer: Name: ${customer.name}, SSN: ${customer.ssn}, Income: ${customer.income}`;
+// System prompt leaks: "You have access to database: postgres://admin:password@..."


The examples include credential-shaped strings (for example, a database URL with admin:password@...). Even in comments, these can trip secret scanners and are easy to cargo-cult into real code. Prefer neutral placeholders like postgres://user:REDACTED@db.example/… or POSTGRES_CONNECTION_STRING.

Suggested change

// System prompt leaks: "You have access to database: postgres://admin:password@..."

// System prompt leaks: "You have access to database: postgres://user:REDACTED@db.example/..."

Copilot · 2026-02-13T13:56:49Z

.github/agents/security-champion.agent.md

+* #file:../instructions/security/owasp-for-web-applications.instructions.md for web application security
+* #file:../instructions/security/owasp-for-llms.instructions.md for AI/ML security


Using #file: to inline two large instruction files (especially the ~500+ line LLM guidance) will significantly increase the agent’s base context and can crowd out user-provided code/context in longer chats. Consider linking to these files by path and summarizing the key rules here, or splitting out a shorter ‘core rules’ file for inlining while keeping the full guidance as reference.

Suggested change

* #file:../instructions/security/owasp-for-web-applications.instructions.md for web application security

* #file:../instructions/security/owasp-for-llms.instructions.md for AI/ML security

* [OWASP for Web Applications](../instructions/security/owasp-for-web-applications.instructions.md): core web application security principles (input validation, authentication, access control, output encoding, and error handling)

* [OWASP for LLMs](../instructions/security/owasp-for-llms.instructions.md): AI/ML and LLM-specific security guidance (prompt injection, data leakage, model abuse, and safety controls)

Copilot · 2026-02-13T13:56:49Z

.github/instructions/security/owasp-for-llms.instructions.md

@@ -0,0 +1,569 @@
+---
+description: "When generating, reviewing, or refactoring code that interacts with Large Language Models (LLMs), read and follow these OWASP Top 10 for LLM Applications (2025) secure coding guidelines to protect against prompt injection, data leakage, and LLM-specific vulnerabilities. Apply these instructions to any LLM integration, agent framework, RAG pipeline, or AI-powered feature. Provide clear and concise security feedback and points of improvement."
+applyTo: '**/*'


applyTo: '**/*' makes these LLM-specific instructions load for every file in the workspace, even when the user is not working on any LLM integration. That can add a lot of irrelevant guidance and token overhead in unrelated chats. Consider narrowing applyTo (for example, to the directories or file types where LLM code lives) or removing applyTo and relying on explicit inclusion from an agent/prompt when needed.

Suggested change

applyTo: '**/*'

applyTo: '.github/**/*.prompt.md|.github/**/*.agent.md|.github/**/*.instructions.md|.github/skills/**/SKILL.md'

Copilot AI review requested due to automatic review settings February 4, 2026 10:06

Copilot started reviewing on behalf of obrocki February 4, 2026 10:06 View session

feat(security-identity): update Security Champion agent description a…

d046fce

…nd tools list 🔒 - Generated by Copilot

Copilot AI reviewed Feb 4, 2026

View reviewed changes

obrocki and others added 2 commits February 4, 2026 13:25

docs(instructions): refine secure coding guidelines for LLM applications

3503c41

- clarify the directive for secure coding practices - emphasize the importance of a security-first mindset - enhance instructions for code reviews and security education 🔒 - Generated by Copilot

Update .github/instructions/owasp-for-web-applications.instructions.md

d0146d2

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 4, 2026 14:03

Copilot started reviewing on behalf of obrocki February 4, 2026 14:04 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

obrocki and others added 2 commits February 4, 2026 14:11

style(security-identity): fix link formatting for Microsoft SDL in se…

7855ee0

…curity champion agent documentation 🔒 - Generated by Copilot

Merge branch 'microsoft:main' into feat/security-champion-agent

6224976

Copilot AI review requested due to automatic review settings February 4, 2026 14:54

Copilot started reviewing on behalf of obrocki February 4, 2026 14:54 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

.github/instructions/owasp-for-llms.instructions.md Outdated Show resolved Hide resolved

.github/agents/security-champion.agent.md Show resolved Hide resolved

obrocki marked this pull request as ready for review February 4, 2026 16:24

obrocki requested a review from a team as a code owner February 4, 2026 16:24

obrocki added 2 commits February 4, 2026 16:30

style(security-identity): refine language and structure in security c…

4bcfda1

…hampion agent documentation 🔒 - Generated by Copilot

Copilot AI review requested due to automatic review settings February 4, 2026 16:54

Copilot started reviewing on behalf of obrocki February 4, 2026 16:54 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

obrocki mentioned this pull request Feb 4, 2026

feat(agents): Add Security Champion agent with SDL and OWASP guidance #416

Open

WilliamBerryiii reviewed Feb 4, 2026

View reviewed changes

.github/agents/security-champion.agent.md Outdated Show resolved Hide resolved

WilliamBerryiii reviewed Feb 4, 2026

View reviewed changes

.github/agents/security-champion.agent.md Outdated Show resolved Hide resolved

WilliamBerryiii added this to the v2.2.0 milestone Feb 5, 2026

chore(instructions): update maturity status to experimental for OWASP…

64def7e

… guidelines 🔒 - Generated by Copilot

katriendg requested changes Feb 5, 2026

View reviewed changes

Copilot AI reviewed Feb 6, 2026

View reviewed changes

.github/instructions/security/owasp-for-web-applications.instructions.md Show resolved Hide resolved

agreaves-ms reviewed Feb 6, 2026

View reviewed changes

.github/instructions/owasp-for-llms.instructions.md Outdated Show resolved Hide resolved

agreaves-ms reviewed Feb 6, 2026

View reviewed changes

.github/instructions/security/owasp-for-llms.instructions.md Show resolved Hide resolved

agreaves-ms reviewed Feb 6, 2026

View reviewed changes

.github/instructions/security/owasp-for-llms.instructions.md Show resolved Hide resolved

agreaves-ms reviewed Feb 6, 2026

View reviewed changes

.github/instructions/security/owasp-for-web-applications.instructions.md Show resolved Hide resolved

agreaves-ms reviewed Feb 6, 2026

View reviewed changes

.github/instructions/security/owasp-for-web-applications.instructions.md Show resolved Hide resolved

WilliamBerryiii modified the milestones: v2.2.0, v2.3.0 Feb 6, 2026

WilliamBerryiii and others added 2 commits February 7, 2026 15:25

Merge branch 'main' into feat/security-champion-agent

d7fa041

Copilot AI review requested due to automatic review settings February 9, 2026 11:16

Copilot started reviewing on behalf of obrocki February 9, 2026 11:16 View session

Copilot AI reviewed Feb 9, 2026

View reviewed changes

.github/instructions/security/owasp-for-web-applications.instructions.md Show resolved Hide resolved

.github/instructions/security/owasp-for-web-applications.instructions.md Show resolved Hide resolved

auyidi1 approved these changes Feb 9, 2026

View reviewed changes

obrocki added 2 commits February 10, 2026 10:42

Merge branch 'main' into feat/security-champion-agent

c0d6bde

Merge branch 'microsoft:main' into feat/security-champion-agent

6f3ead2

Copilot AI review requested due to automatic review settings February 10, 2026 20:13

Copilot started reviewing on behalf of obrocki February 10, 2026 20:14 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes

.github/instructions/security/owasp-for-web-applications.instructions.md Outdated Show resolved Hide resolved

Update .github/instructions/security/owasp-for-web-applications.instr…

54916ad

…uctions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 13, 2026 13:22

Merge branch 'main' into feat/security-champion-agent

ee54a85

Copilot started reviewing on behalf of obrocki February 13, 2026 13:23 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

.github/instructions/security/owasp-for-web-applications.instructions.md Show resolved Hide resolved

.github/instructions/security/owasp-for-web-applications.instructions.md Show resolved Hide resolved

.github/instructions/security/owasp-for-llms.instructions.md Show resolved Hide resolved

Update .github/instructions/security/owasp-for-llms.instructions.md

a8c5966

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 13, 2026 13:53

Update .github/instructions/security/owasp-for-web-applications.instr…

d698f0b

…uctions.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started reviewing on behalf of obrocki February 13, 2026 13:53 View session

Copilot AI reviewed Feb 13, 2026

View reviewed changes

	// System prompt leaks: "You have access to database: postgres://admin:password@..."
	// System prompt leaks: "You have access to database: postgres://user:REDACTED@db.example/..."

		* #file:../instructions/security/owasp-for-web-applications.instructions.md for web application security
		* #file:../instructions/security/owasp-for-llms.instructions.md for AI/ML security

	applyTo: '*/'
	applyTo: '.github/*/.prompt.md\|.github/*/.agent.md\|.github/*/.instructions.md\|.github/skills/**/SKILL.md'

Adds Security Champion chat / agent mode to provide comprehensive security guidance by integrating Microsoft's Security Development Lifecycle (SDL) practices alongside existing OWASP frameworks. #408

Are you sure you want to change the base?

Adds Security Champion chat / agent mode to provide comprehensive security guidance by integrating Microsoft's Security Development Lifecycle (SDL) practices alongside existing OWASP frameworks. #408

Conversation

obrocki commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Description

Related Issue(s)

Type of Change

Sample Prompts and Usage

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

codecov-commenter commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

WilliamBerryiii commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

katriendg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

obrocki commented Feb 4, 2026 •

edited

Loading

codecov-commenter commented Feb 4, 2026 •

edited

Loading

WilliamBerryiii commented Feb 4, 2026 •

edited

Loading