You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2026/03/26 08:37:24 UTC
[PR] Add initial `AGENTS.md` for AI-assisted vulnerability research [logging-log4j2]
ppkarwasz opened a new pull request, #4083:
URL: https://github.com/apache/logging-log4j2/pull/4083
This introduces an `AGENTS.md` file, which AI coding agents (such as Claude Code, Cursor, and GitHub Copilot) read automatically when entering a repository. It lets the project guide agent behavior without relying on researchers to configure their tools manually.
This first version targets vulnerability research workflows. Before an agent drafts or files a report, it is instructed to read:
- **Threat model**: to establish what is and isn't in scope
- **VDR**: to catch duplicates before they are reported
- **Security FAQ**: to filter out known, intentional behaviors that are not vulnerabilities
All three documents are referenced by their raw source URLs rather than rendered pages. This reduces token consumption and avoids context window pressure when agents are processing large codebases alongside these files.
The expected outcome is fewer duplicate reports, fewer false positives, and less triage burden.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add initial `AGENTS.md` for AI-assisted vulnerability research [logging-log4j2]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #4083:
URL: https://github.com/apache/logging-log4j2/pull/4083#issuecomment-4138060561
> Why?
Why do I want to add an `AGENTS.md`? We are receiving a lot of invalid security reports, often duplicates, certainly at least AI-aided. With such a file we control the instructions that AI agents follow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add initial `AGENTS.md` for AI-assisted vulnerability research [logging-log4j2]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on PR #4083:
URL: https://github.com/apache/logging-log4j2/pull/4083#issuecomment-4136847704
Why?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add initial `AGENTS.md` for AI-assisted vulnerability research [logging-log4j2]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on PR #4083:
URL: https://github.com/apache/logging-log4j2/pull/4083#issuecomment-4138283910
> > Why?
>
> Why do I want to add an `AGENTS.md`? We are receiving a lot of invalid security reports, often duplicates, certainly at least AI-aided. With such a file we control the instructions that AI agents follow.
You're assuming a lot here. I hope to be wrong that this will be treated like robot.txt files. IOW, ignored by so many companies as to become useless and just clutter in our repository.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add initial `AGENTS.md` for AI-assisted vulnerability research [logging-log4j2]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz merged PR #4083:
URL: https://github.com/apache/logging-log4j2/pull/4083
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org