Wrote a blog post about using instruction.md files to guide GitHub #Copilot to avoid risky code dependencies. The approach fills some of the gaps of traditional SAST tool compliance approaches - repos can pick their own risk thresholds instead of being limited to company-wide minimum thresholds & community health risks are flagged before any written…but won’t replace them as hard to enforce as gate.

https://justingosses.com/blog/instruction-files-to-help-copilot-use-less-risky-dependencies