starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-12 07:43:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

docs(agents): document editing advisory comments and linking commit SHAs

Browse Source 
Add the gh api PATCH command for editing a security advisory comment, and note that advisory comments do not auto-link bare commit SHAs, so they must be written as Markdown links to the commit URL.
This commit is contained in:
Andras Bacsai
2026-11-09 11:20:06 +01:00
parent 09f4aedb43
commit 2e63c2e57e
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+1 -1
View File
@@ -197,7 +197,7 @@ Before you rate a vulnerability or write an advisory, find the security boundary
- If a path is reachable by a member only because of a different missing authorization check, report that check as the main issue, with high severity. Rate each injection behind it by the role it needs when the check works.
- Always fix low-severity findings (escape shell arguments, validate input, confine paths) when you find them. Do not dismiss them because the attacker is an admin.
- Do not put exploit details, payloads, or unreleased advisory IDs in commits, PR descriptions, code comments, or this file.
- To reply on a security advisory, add a comment. Do not edit the advisory description. Comments API (public preview): `gh api repos/coollabsio/coolify/security-advisories/<GHSA-ID>/comments` lists comments, and `gh api -X POST repos/coollabsio/coolify/security-advisories/<GHSA-ID>/comments -F body=@comment.md` adds one. The API cannot delete comments.
- To reply on a security advisory, add a comment. Do not edit the advisory description. Comments API (public preview): `gh api repos/coollabsio/coolify/security-advisories/<GHSA-ID>/comments` lists comments, and `gh api -X POST repos/coollabsio/coolify/security-advisories/<GHSA-ID>/comments -F body=@comment.md` adds one. The API cannot delete comments. `gh api -X PATCH repos/coollabsio/coolify/security-advisories/<GHSA-ID>/comments/<comment-id> -F body=@comment.md` edits one. Advisory comments do not link bare commit SHAs: write `[<short-sha>](https://github.com/coollabsio/coolify/commit/<full-sha>)`.
### Event Broadcasting
- Laravel Reverb WebSocket server for real-time updates (port 6001) and a Node terminal WebSocket server (port 6002), both run inside the `coolify` container as s6 services