docs: rewrite README following 2026 OSS conventions#1
Conversation
Restructure with badges, why-this-exists framing, quickstart, concrete use cases (webhooks, mobile testing, demos, CORS shimming, header/body auth injection), compatibility table, and security disclosure pointer. Content unchanged in substance — surfacing it for new readers.
📝 WalkthroughWalkthroughThe README was restructured with an updated "Why this exists" introduction and streamlined "Quickstart" section, followed by scenario-based "Use cases" guidance for webhooks, mobile testing, and demoing. Configuration documentation was expanded with JSON parsing rules for body injection, CORS examples, and a new configuration reference table mapping appsettings files. Security and project layout sections were rewritten for clarity. ChangesREADME Restructuring & Documentation Update
Estimated Code Review Effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 60 minutes.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@README.md`:
- Around line 106-117: Add a brief warning above the example stating not to
store plaintext secrets in appsettings.json and replace any hardcoded secret
values in the "Routes" -> "default" -> "Transforms" example (e.g., the
RequestHeader "X-Api-Key" "Set" value and any InjectJsonField:* examples) with
an environment/user-secrets placeholder (for example %UPSTREAM_API_KEY% or a
reference to user-secrets) and include a one-line note showing how to set that
env var or use dotnet user-secrets so readers know to inject secrets at runtime
instead of committing them.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| ```jsonc | ||
| "Routes": { | ||
| "default": { | ||
| "ClusterId": "default", | ||
| "CorsPolicy": "default", | ||
| "Match": { "Path": "{**catch-all}" }, | ||
| "Transforms": [ | ||
| { "RequestHeader": "X-Server-Secret", "Set": "your-secret-here" }, | ||
| { "RequestHeader": "X-Api-Key", "Set": "your-secret-here" }, | ||
| { "RequestHeader": "X-Trace", "Append": "proxy" } | ||
| ] | ||
| } | ||
| } | ||
| ``` |
There was a problem hiding this comment.
Avoid documenting plaintext secrets in appsettings.json examples.
The examples currently model putting credentials directly in config ("Set": "your-secret-here" and InjectJsonField:*). Please add a short warning and show env/user-secrets substitution so readers don’t accidentally commit real credentials.
Suggested doc tweak
### Inject auth headers before forwarding
Public-facing tunnel, secret-bearing upstream. Use route transforms:
+⚠️ Do not store real secrets in committed `appsettings.json`.
+Prefer environment variables or .NET user-secrets for local development.
```jsonc
"Routes": {
"default": {
@@
- { "RequestHeader": "X-Api-Key", "Set": "your-secret-here" },
+ { "RequestHeader": "X-Api-Key", "Set": "%UPSTREAM_API_KEY%" },
{ "RequestHeader": "X-Trace", "Append": "proxy" }
]
}
} ### Inject auth fields into JSON request bodies
For upstreams that authenticate via body fields, not headers:
+⚠️ Keep injected auth values out of source control; load them from secret stores/env vars.Also applies to: 125-137
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@README.md` around lines 106 - 117, Add a brief warning above the example
stating not to store plaintext secrets in appsettings.json and replace any
hardcoded secret values in the "Routes" -> "default" -> "Transforms" example
(e.g., the RequestHeader "X-Api-Key" "Set" value and any InjectJsonField:*
examples) with an environment/user-secrets placeholder (for example
%UPSTREAM_API_KEY% or a reference to user-secrets) and include a one-line note
showing how to set that env var or use dotnet user-secrets so readers know to
inject secrets at runtime instead of committing them.
1 participant
Restructure with badges, why-this-exists framing, quickstart, concrete use cases (webhooks, mobile testing, demos, CORS shimming, header/body auth injection), compatibility table, and security disclosure pointer. Content unchanged in substance — surfacing it for new readers.
Summary by CodeRabbit