diff --git a/AGENTS.md b/AGENTS.md index 62df0e509c..ffd5c9c65a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -197,6 +197,7 @@ Before you rate a vulnerability or write an advisory, find the security boundary - If a path is reachable by a member only because of a different missing authorization check, report that check as the main issue, with high severity. Rate each injection behind it by the role it needs when the check works. - Always fix low-severity findings (escape shell arguments, validate input, confine paths) when you find them. Do not dismiss them because the attacker is an admin. - Do not put exploit details, payloads, or unreleased advisory IDs in commits, PR descriptions, code comments, or this file. +- To reply on a security advisory, add a comment. Do not edit the advisory description. Comments API (public preview): `gh api repos/coollabsio/coolify/security-advisories//comments` lists comments, and `gh api -X POST repos/coollabsio/coolify/security-advisories//comments -F body=@comment.md` adds one. The API cannot delete comments. ### Event Broadcasting - Laravel Reverb WebSocket server for real-time updates (port 6001) and a Node terminal WebSocket server (port 6002), both run inside the `coolify` container as s6 services