From ab04c21254b1efa39528ec6f85197d2040447708 Mon Sep 17 00:00:00 2001 From: Rogee Date: Thu, 20 Aug 2026 22:37:28 +0800 Subject: [PATCH] docs(H-389): tighten CDP security guidance Co-authored-by: multica-agent --- AGENTS.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 63c4739..eb69ce1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -59,7 +59,8 @@ CDP observes browser-internal decrypted events. It is not a client/server proxy, ## Security and reliability - Never commit or log CDP tokens, cookies, `Authorization`, `Set-Cookie`, credentials, full sensitive bodies, or production data. -- Use short-lived CDP credentials over a protected internal or TLS connection, with session isolation and auditable access. +- Never put CDP tokens, `Cookie`, `Authorization`, credentials, or unredacted sensitive values in any URL. +- Treat CDP access as browser-high-privilege: use short-lived credentials, protected internal or TLS transport, least privilege, session isolation, and auditable access. - Redact sensitive headers and bodies before persistence or export; enforce body, event, frame, and retention limits. - Treat response bodies as optional: cache, target closure, protocol behavior, or lifecycle timing may make them unavailable. - Report disconnects, target closure, dropped events, and body-read failures without stopping the browser workload.