Add security disclosure guidance to AGENTS.md#13720
Merged
Merged
Conversation
Instruct agents to never post security-related content publicly and to file an advisory per SECURITY.md instead. Co-authored-by: Copilot <[email protected]>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a prominent “Security Disclosures” section to AGENTS.md to steer agents away from public security disclosures and toward the repository’s established reporting process in .github/SECURITY.md.
Changes:
- Introduces a new “Security Disclosures” section near the top of
AGENTS.md. - Links to
.github/SECURITY.mdas the source of truth for reporting guidance.
Show a summary per file
| File | Description |
|---|---|
| AGENTS.md | Adds security disclosure guidance and a pointer to the repo’s security reporting policy. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 1
babakks
approved these changes
Jun 24, 2026
BagToad
enabled auto-merge (squash)
June 24, 2026 16:10
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Jul 9, 2026
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.94.0` → `v2.96.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.96.0`](https://github.com/cli/cli/releases/tag/v2.96.0): GitHub CLI 2.96.0 [Compare Source](cli/cli@v2.95.0...v2.96.0) #### Security A security vulnerability has been identified, and fixed, that could allow command execution on a user's computer when connecting to a malicious Codespace via `gh codespace jupyter`. Users of `gh codespace jupyter` are advised to update gh to version v2.96.0 as soon as possible. For more information see: <GHSA-8cg3-r6g9-fpg2> #### Download release assets without authentication `gh release download` now works against public repositories without authentication, matching `gh extension install`. A token is still used when one is present: ```shell # Download assets from a public repository, no login required gh release download v2.96.0 --repo cli/cli ``` #### What's Changed ##### ✨ Features - Allow `gh release download` without authentication on public repositories by [@​BagToad](https://github.com/BagToad) in [#​13723](cli/cli#13723) - Detect additional third-party coding agents by [@​BagToad](https://github.com/BagToad) in [#​13722](cli/cli#13722) - Support `antigravity-cli` and `antigravity2.0` in `gh skill` by [@​BagToad](https://github.com/BagToad) in [#​13784](cli/cli#13784) ##### 🐛 Fixes - fix: show checks summary when all checks were cancelled by [@​s3onghyun](https://github.com/s3onghyun) in [#​13679](cli/cli#13679) - fix(skills): install universal agent to `~/.agents/skills` by [@​toller892](https://github.com/toller892) in [#​13681](cli/cli#13681) - fix(skills): honor `--dir` without agent prompt by [@​happysnaker](https://github.com/happysnaker) in [#​13766](cli/cli#13766) - Fix concurrent map writes in codespace port forwarding by [@​williammartin](https://github.com/williammartin) in [#​13313](cli/cli#13313) - Use `int64` for GitHub database IDs by [@​williammartin](https://github.com/williammartin) in [#​13403](cli/cli#13403) ##### 📚 Docs & Chores - Pin reusable triage workflows to a commit SHA by [@​BagToad](https://github.com/BagToad) in [#​13705](cli/cli#13705) - Add security disclosure guidance to `AGENTS.md` by [@​BagToad](https://github.com/BagToad) in [#​13720](cli/cli#13720) - Clarify `--clone` boolean flag behaviour in `gh repo fork` help by [@​BagToad](https://github.com/BagToad) in [#​13786](cli/cli#13786) - Fix flaky `TestHuhPrompterMultiSelectWithSearchPersistence` on slow architectures by [@​pdostal](https://github.com/pdostal) in [#​13675](cli/cli#13675) - docs(search): add examples for multiple qualifiers by [@​happysnaker](https://github.com/happysnaker) in [#​13756](cli/cli#13756) - docs: fix broken anchor link in release-process-deep-dive by [@​patrickwehbe](https://github.com/patrickwehbe) in [#​13688](cli/cli#13688) - docs: fix broken install command and link/grammar errors by [@​patrickwehbe](https://github.com/patrickwehbe) in [#​13690](cli/cli#13690) - docs: fix duplicated word in primer README by [@​s3onghyun](https://github.com/s3onghyun) in [#​13677](cli/cli#13677) #####Dependencies - chore(deps): bump github.com/microsoft/dev-tunnels from 0.1.19 to 0.1.27 by [@​dependabot](https://github.com/dependabot) in [#​13708](cli/cli#13708) - chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13703](cli/cli#13703) - chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by [@​dependabot](https://github.com/dependabot) in [#​13702](cli/cli#13702) - chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by [@​dependabot](https://github.com/dependabot) in [#​13740](cli/cli#13740) - chore(deps): bump actions/attest from 4.1.0 to 4.1.1 by [@​dependabot](https://github.com/dependabot) in [#​13754](cli/cli#13754) - chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by [@​dependabot](https://github.com/dependabot) in [#​13759](cli/cli#13759) - chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by [@​dependabot](https://github.com/dependabot) in [#​13779](cli/cli#13779) #### New Contributors - [@​patrickwehbe](https://github.com/patrickwehbe) made their first contribution in [#​13688](cli/cli#13688) - [@​s3onghyun](https://github.com/s3onghyun) made their first contribution in [#​13679](cli/cli#13679) - [@​toller892](https://github.com/toller892) made their first contribution in [#​13681](cli/cli#13681) - [@​happysnaker](https://github.com/happysnaker) made their first contribution in [#​13756](cli/cli#13756) **Full Changelog**: <cli/cli@v2.95.0...v2.96.0> ### [`v2.95.0`](https://github.com/cli/cli/releases/tag/v2.95.0): GitHub CLI 2.95.0 [Compare Source](cli/cli@v2.94.0...v2.95.0) #### Read repository files and directories with `gh repo read-file` and `gh repo read-dir` Two new preview commands read repository contents without cloning: ```shell # Read a single file to stdout gh repo read-file README.md --repo cli/cli # Read from a specific branch, tag, or commit gh repo read-file go.mod --ref v2.94.0 --repo cli/cli # Write a file to disk (use --clobber to overwrite) gh repo read-file README.md --output ./README.md --repo cli/cli # List the entries in a directory gh repo read-dir script --repo cli/cli ``` Both commands default to the repository's default branch, accept `--ref` to target any branch, tag, or commit, and support `--json`, `--jq`, and `--template` for scripting. This makes it easy for agents and automation to inspect a repo without a full checkout. > \[!NOTE] > `gh repo read-file` and `gh repo read-dir` are in preview and subject to change without notice. #### What's Changed ##### ✨ Features - feat: add `repo read-file` and `repo read-dir` by [@​babakks](https://github.com/babakks) in [#​13580](cli/cli#13580) - feat(skills): list available skills when install runs non-interactively by [@​SamMorrowDrums](https://github.com/SamMorrowDrums) in [#​13548](cli/cli#13548) - Support custom CLAUDE\_CONFIG\_DIR in install by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13523](cli/cli#13523) ##### 🐛 Fixes - fix(skills): stage updates in a temp dir and swap in-place by [@​SamMorrowDrums](https://github.com/SamMorrowDrums) in [#​13449](cli/cli#13449) ##### 📚 Docs & Chores - Make filtering by bot authors more discoverable by [@​BagToad](https://github.com/BagToad) in [#​13642](cli/cli#13642) - docs(discussion): polish help docs by [@​babakks](https://github.com/babakks) in [#​13632](cli/cli#13632) - Bump Go in devcontainer by [@​spenserblack](https://github.com/spenserblack) in [#​13674](cli/cli#13674) #####
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds a Security Disclosures section to
AGENTS.mddirecting agents to never post security-related content and to file an advisory instead.Key Points
Placed near the top of the file so it is hard to miss. It defers to
SECURITY.mdrather than restating the reporting steps, keeping one source of truth.Notes for reviewers
One docs-only change. Read the new Security Disclosures section in
AGENTS.md.Additional Context
Our
SECURITY.mddefines the reporting process this section points to.