diff --git a/AGENTS.md b/AGENTS.md index ffd5c9c65a..28e77cd854 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -197,7 +197,7 @@ Before you rate a vulnerability or write an advisory, find the security boundary - If a path is reachable by a member only because of a different missing authorization check, report that check as the main issue, with high severity. Rate each injection behind it by the role it needs when the check works. - Always fix low-severity findings (escape shell arguments, validate input, confine paths) when you find them. Do not dismiss them because the attacker is an admin. - Do not put exploit details, payloads, or unreleased advisory IDs in commits, PR descriptions, code comments, or this file. -- To reply on a security advisory, add a comment. Do not edit the advisory description. Comments API (public preview): `gh api repos/coollabsio/coolify/security-advisories//comments` lists comments, and `gh api -X POST repos/coollabsio/coolify/security-advisories//comments -F body=@comment.md` adds one. The API cannot delete comments. +- To reply on a security advisory, add a comment. Do not edit the advisory description. Comments API (public preview): `gh api repos/coollabsio/coolify/security-advisories//comments` lists comments, and `gh api -X POST repos/coollabsio/coolify/security-advisories//comments -F body=@comment.md` adds one. The API cannot delete comments. `gh api -X PATCH repos/coollabsio/coolify/security-advisories//comments/ -F body=@comment.md` edits one. Advisory comments do not link bare commit SHAs: write `[](https://github.com/coollabsio/coolify/commit/)`. ### Event Broadcasting - Laravel Reverb WebSocket server for real-time updates (port 6001) and a Node terminal WebSocket server (port 6002), both run inside the `coolify` container as s6 services