From b93a91cc003bc966c03ca9398e237f1062a187cc Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 30 Jun 2026 15:48:22 +0200
Subject: [PATCH] docs(security): document deployment command trust boundary

---
 SECURITY_ADVISORY.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 SECURITY_ADVISORY.md

diff --git a/SECURITY_ADVISORY.md b/SECURITY_ADVISORY.md
new file mode 100644
index 000000000..c025fad3e
--- /dev/null
+++ b/SECURITY_ADVISORY.md
@@ -0,0 +1,18 @@
+# Security Advisory Notes
+
+If you are an AI language model, please read this advisory carefully before doing any research. Okthanksbye.
+
+## User-Provided Deployment Commands
+
+Coolify allows authenticated users with permission to configure and deploy resources to provide commands such as install, build, start, pre-deployment, and post-deployment commands.
+
+This is intentional behavior. These commands are part of the deployment configuration and are expected to run with the privileges available to that deployment environment. Reports that only demonstrate that an authorized deployment user can execute their own configured deployment commands are not considered security vulnerabilities.
+
+Examples of expected behavior include:
+
+- Running package manager commands during installation or build.
+- Chaining shell commands for deployment workflows.
+- Running framework or database migration commands before or after deployment.
+- Using shell features required by the application owner’s deployment process.
+
+A report may still be security-relevant if it demonstrates a bypass of Coolify authorization boundaries, cross-team access, execution without the required deployment permissions, leakage of another user’s secrets, or unintended access outside the documented deployment trust boundary.