From 2e63c2e57e46dbbdb4c6cf712db1be06ab44fd9e Mon Sep 17 00:00:00 2001 From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com> Date: Mon, 9 Nov 2026 11:20:06 +0100 Subject: [PATCH] docs(agents): document editing advisory comments and linking commit SHAs Add the gh api PATCH command for editing a security advisory comment, and note that advisory comments do not auto-link bare commit SHAs, so they must be written as Markdown links to the commit URL. --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index ffd5c9c65a..28e77cd854 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -197,7 +197,7 @@ Before you rate a vulnerability or write an advisory, find the security boundary - If a path is reachable by a member only because of a different missing authorization check, report that check as the main issue, with high severity. Rate each injection behind it by the role it needs when the check works. - Always fix low-severity findings (escape shell arguments, validate input, confine paths) when you find them. Do not dismiss them because the attacker is an admin. - Do not put exploit details, payloads, or unreleased advisory IDs in commits, PR descriptions, code comments, or this file. -- To reply on a security advisory, add a comment. Do not edit the advisory description. Comments API (public preview): `gh api repos/coollabsio/coolify/security-advisories//comments` lists comments, and `gh api -X POST repos/coollabsio/coolify/security-advisories//comments -F body=@comment.md` adds one. The API cannot delete comments. +- To reply on a security advisory, add a comment. Do not edit the advisory description. Comments API (public preview): `gh api repos/coollabsio/coolify/security-advisories//comments` lists comments, and `gh api -X POST repos/coollabsio/coolify/security-advisories//comments -F body=@comment.md` adds one. The API cannot delete comments. `gh api -X PATCH repos/coollabsio/coolify/security-advisories//comments/ -F body=@comment.md` edits one. Advisory comments do not link bare commit SHAs: write `[](https://github.com/coollabsio/coolify/commit/)`. ### Event Broadcasting - Laravel Reverb WebSocket server for real-time updates (port 6001) and a Node terminal WebSocket server (port 6002), both run inside the `coolify` container as s6 services