AI Repository Security Baseline

What it is

AI Repository Security Baseline is an Apache 2.0 repository of drop-in agent instruction files. Every tool-specific file points to one shared AGENTS.md, which holds fifteen sections of rules. The page says the target is accidental failures, such as an agent reading .env, installing requets instead of requests, or editing a GitHub Actions workflow. It does not target deliberate attacks.

How it works

Each agent reads the filename it already looks for, and that file defers to AGENTS.md. The files listed are:

• CLAUDE.md (Claude Code)
• .cursor/rules/*.mdc (Cursor, six rule files scoped by file type)
• .github/copilot-instructions.md (Copilot)
• .windsurfrules (Windsurf)
• .clinerules (Cline)
• .continuerules (Continue.dev)
• .aider.conf.yml plus CONVENTIONS.md (Aider)
• .amazonq/rules/ (Amazon Q Developer)
• .junie/guidelines.md (Junie)
• devin.md (Devin)
• .sourcegraph/cody.json (Cody)

OpenAI Codex reads AGENTS.md directly and needs no extra file.

A second layer of ignore files stops agents from reading secrets at all: .aiignore is the canonical list, with tool-specific copies .cursorignore, .clineignore and .aiderignore. They cover .env, private keys, cloud credentials and SSH keys.

What to do

1. Copy the files into the repo.
2. Fill in the [PLACEHOLDER] fields in AGENTS.md: project overview, stack, file structure, naming conventions, git workflow, allowed build/test/lint commands, and project-specific protected files. The page says agents can propose values from your code for you to approve.
3. Delete the tool configs you do not use.
4. Commit and push.

The minimum viable set is AGENTS.md plus .aiignore. Remove sections that do not apply, such as the WCAG 2.1 AA rules for a backend service or the CI/CD rules if you have no CI.

Rules worth checking against your own policy:

• Protected files (CI configs, Dockerfiles, lock files, infrastructure code, CODEOWNERS) need explicit permission and a before/after diff.
• Dependency proposals must include version, popularity, license and known vulnerabilities, and package names must be verified for typosquatting.
• Agents must not regenerate lock files, suppress vulnerability warnings, disable tests or use --no-verify.
• Agents stay inside the repository, avoid ~/.ssh and ~/.aws, make no unnecessary outbound calls, and need confirmation for rm -rf, database drops and force-pushes.
• Privacy rules cover no PII in logs, redacted error messages, no telemetry without consent, and support for GDPR access, deletion and export.

To contribute, change AGENTS.md first, then propagate the change to the tool-specific files.

Caveats

The page states that rules are not guarantees. Instruction files can be bypassed, especially through prompt injection, and nothing enforces them. Where possible, use deterministic controls such as file permissions, network policy and CI gates instead.

The baseline does not cover a compromised machine, upstream supply chain attacks or agent zero-days. It does not make a project GDPR-compliant, SOC 2-ready or audit-proof. The authors say to review and adapt the files to your threat model, and the repository is provided as-is with no liability.