Skip to content

docs: add Security & Quality Conventions to copilot-instructions.md - #269

Merged
TheWitness merged 1 commit into
developfrom
docs/security-quality-conventions
Sep 22, 2026
Merged

TheWitness merged 1 commit into
developfrom
docs/security-quality-conventions

Conversation

@TheWitness

Copy link
Copy Markdown
Member

Adds a "Security & Quality Conventions" section to .github/copilot-instructions.md, documenting recurring patterns established across the Cacti plugin fleet:

  • No hardcoded third-party hosts (expose as a setting instead)
  • Prepared statements over db_qstr()
  • html_escape_request_var() over html_escape(get_request_var(...))
  • Hardened unserialize() (allow_classes => false)
  • i18n text domain on every translated string
  • The api_plugin_db_table_create()/api_plugin_db_add_column() idempotent table-creation API
  • The standard PHPDoc block shape (description, blank comment, @param, blank comment, @return)

Documentation-only change, no functional/behavioral changes.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The documentation changes are clear, consistent, and introduce no functional behavior.

Review effort: Lite
Findings: None

What changed in this PR

Documents recurring security and quality conventions for Cacti plugin development.

Changes:

  • Adds guidance on secure URLs, SQL, escaping, deserialization, and i18n.
  • Documents database API and PHPDoc conventions.
File Description
.github/​copilot-instructions.md Adds Security & Quality Conventions guidance.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@TheWitness
TheWitness merged commit 35c34fd into develop Sep 22, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants