From 09f4aedb43123bb23a9fdba8491411b66905c2e0 Mon Sep 17 00:00:00 2001 From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com> Date: Mon, 9 Nov 2026 11:07:01 +0100 Subject: [PATCH] docs(agents): add security advisory comment workflow via gh api Document replying to security advisories through comments instead of editing the advisory description, including the gh api commands to list and post comments and the note that comments cannot be deleted. --- AGENTS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/AGENTS.md b/AGENTS.md index 62df0e509c..ffd5c9c65a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -197,6 +197,7 @@ Before you rate a vulnerability or write an advisory, find the security boundary - If a path is reachable by a member only because of a different missing authorization check, report that check as the main issue, with high severity. Rate each injection behind it by the role it needs when the check works. - Always fix low-severity findings (escape shell arguments, validate input, confine paths) when you find them. Do not dismiss them because the attacker is an admin. - Do not put exploit details, payloads, or unreleased advisory IDs in commits, PR descriptions, code comments, or this file. +- To reply on a security advisory, add a comment. Do not edit the advisory description. Comments API (public preview): `gh api repos/coollabsio/coolify/security-advisories//comments` lists comments, and `gh api -X POST repos/coollabsio/coolify/security-advisories//comments -F body=@comment.md` adds one. The API cannot delete comments. ### Event Broadcasting - Laravel Reverb WebSocket server for real-time updates (port 6001) and a Node terminal WebSocket server (port 6002), both run inside the `coolify` container as s6 services