rogee/lume-ctrl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(H-389): tighten CDP security guidance

Browse Source 
Co-authored-by: multica-agent <github@multica.ai>
This commit is contained in:
rogee
2026-08-20 22:37:28 +08:00
co-authored by multica-agent
parent 9c19721991
commit ab04c21254
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+2 -1
View File
@@ -59,7 +59,8 @@ CDP observes browser-internal decrypted events. It is not a client/server proxy,
## Security and reliability
- Never commit or log CDP tokens, cookies, `Authorization`, `Set-Cookie`, credentials, full sensitive bodies, or production data.
- Use short-lived CDP credentials over a protected internal or TLS connection, with session isolation and auditable access.
- Never put CDP tokens, `Cookie`, `Authorization`, credentials, or unredacted sensitive values in any URL.
- Treat CDP access as browser-high-privilege: use short-lived credentials, protected internal or TLS transport, least privilege, session isolation, and auditable access.
- Redact sensitive headers and bodies before persistence or export; enforce body, event, frame, and retention limits.
- Treat response bodies as optional: cache, target closure, protocol behavior, or lifecycle timing may make them unavailable.
- Report disconnects, target closure, dropped events, and body-read failures without stopping the browser workload.