[touchweb-vincent]

Hello,

what

This PR adds explicit warning notices to several rule-exclusion examples and documentation sections.
These notices remind users that:

• Certain exclusions shown in examples are not safe to apply globally.
• Such configurations must be used only in very specific contexts.
• The examples are meant to illustrate syntax, not to recommend real-world use.
• The goal is to make CRS documentation safer and more self-explanatory, reducing the risk of misconfiguration.

why

To help users avoid unsafe tuning practices that could compromise the effectiveness of CRS.

Some examples and documentation snippets may look harmless, but when reused without proper context they can lead to overly broad exclusions or rule bypasses.

Adding warnings provides clear guidance about when an example is for demonstration only, and when it should never be used in production.

[airween]

@touchweb-vincent,

thanks for your PR - please make a bit more informative comment under the PR. For example, please see this. The two relevant questions are "why" and "what", with one-one sentences.

Thank you again.

[touchweb-vincent]

@airween done, does this sound good to you ?

[airween]

I'm not a native English speaker so it's not the best idea to give a review, but I made a suggestion.

Cc: @theseion, @RedXanadu.

[airween]

@airween done, does this sound good to you ?

Yes, excellent! Thank you!

[theseion]

Please work through the open comments @touchweb-vincent.

[touchweb-vincent]

@theseion I was waiting for your point of view before committing the changes.

The changes have now been committed.

[theseion]

Please mark comments as resolved when you're done with them (two where still unresolved). That helps me, as a reviewer, to know that you've seen every comment. If you decide to not apply a suggestion or act on a comment (which is a valid choice), please provide a reason for why. Otherwise I have to assume you didn't read or understand the comment.

[theseion]

Please resolve the open comments @touchweb-vincent.

[touchweb-vincent]

@theseion All comments have been marked as resolved here.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: c9d128bd-6c7e-44bf-8323-ec1240c2c381

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[EsadCetiner]

Suggested change

	This type of broad exclusion is dangerous and should only be considered if the rules are causing problems _and_ the application is not vulnerable to the specific attack, e.g., the PHP rules cause issues and no application behind the WAF uses PHP.
	This type of broad exclusion is dangerous and should only be considered if the rule is noisy _and_ the application is not vulnerable to the specific attack, e.g. PHP rules are causing many false positives but the application behind the WAF doesn't use PHP.