From 062e430f0475d3341123f0a7037ed6b3080846d8 Mon Sep 17 00:00:00 2001
From: deluciac <chris.rob.delucia@gmail.com>
Date: Sun, 16 Aug 2026 17:25:55 -0700
Subject: [PATCH 1/3] Adding coderabbit base config with more exclusions

---
 .coderabbit.yaml | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .coderabbit.yaml

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 0000000..8881b29
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,40 @@
+language: "en-US"
+tone_instructions: >-
+  Be concise, evidence-based, and security-first. Lead with exploitable impact,
+  distinguish intentional labs from regressions, and suppress cosmetic feedback.
+
+reviews:
+  profile: "chill"
+  request_changes_workflow: true
+  high_level_summary: false
+  auto_review:
+    enabled: true
+    drafts: false
+    ignore_title_keywords:
+      - "!do-not-coderabbit-review"
+
+  path_filters:
+    - "!**/docs/**"
+    - "!**/tests/**"
+    - "!**/prompts/**"
+    - "!**/.github/**"
+
+
+  path_instructions:
+    - path: "**/*"
+      instructions: |
+        PwnzzAI is deliberately insecure for education. Prioritize security,
+        then correctness, then maintainability. Rank actionable findings as
+        Critical, High, Medium, or Low. Explain the attack path, impact,
+        evidence, and smallest safe remediation. Do not report style-only issues.
+
+    - path: "application/vulnerabilities/**"
+      instructions: |
+        The advertised weakness in each lab is intentional. Do not flag it
+        solely because it exists. Flag unintended or undocumented weakness
+        classes, escape from the lab boundary, exposure of real secrets or data,
+        harmful external side effects, insecure behavior becoming a default
+        outside the lab, broken exploitability, or weakened hardened examples.
+
+chat:
+  auto_reply: false
\ No newline at end of file

From 9ff25ddf363141533d1b8b6373bc7fa376723760 Mon Sep 17 00:00:00 2001
From: deluciac <76057103+deluciac@users.noreply.github.com>
Date: Sun, 16 Aug 2026 18:10:47 -0700
Subject: [PATCH 2/3] Updated to use labels instead of PR titles

We want repo maintainers to be able to opt-out of coderabbit auto-review, not necessarily anyone who can just add it to PR title
---
 .coderabbit.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index 8881b29..c8d671d 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -10,7 +10,7 @@ reviews:
   auto_review:
     enabled: true
     drafts: false
-    ignore_title_keywords:
+    labels:
       - "!do-not-coderabbit-review"
 
   path_filters:
@@ -37,4 +37,4 @@ reviews:
         outside the lab, broken exploitability, or weakened hardened examples.
 
 chat:
-  auto_reply: false
\ No newline at end of file
+  auto_reply: false

From 7b34fa2e102e99d72234132ab8389fb8b1e057a4 Mon Sep 17 00:00:00 2001
From: deluciac <76057103+deluciac@users.noreply.github.com>
Date: Sun, 16 Aug 2026 18:13:15 -0700
Subject: [PATCH 3/3] Removed path filter for .github directory

May want to include this in case malicious gh actions/scripts
---
 .coderabbit.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index c8d671d..375d334 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -17,7 +17,6 @@ reviews:
     - "!**/docs/**"
     - "!**/tests/**"
     - "!**/prompts/**"
-    - "!**/.github/**"
 
 
   path_instructions: