From 80b07984c4c43769324760a3c58190b6f59efc6a Mon Sep 17 00:00:00 2001
From: Tianyi Cui <53024+tianyicui@users.noreply.github.com>
Date: Sun, 19 Jul 2026 21:56:02 +0800
Subject: [PATCH] docs(web): codify credentialed redirect policy

---
 packages/web/AGENTS.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 packages/web/AGENTS.md

diff --git a/packages/web/AGENTS.md b/packages/web/AGENTS.md
new file mode 100644
index 0000000000..1b9721d9ca
--- /dev/null
+++ b/packages/web/AGENTS.md
@@ -0,0 +1,5 @@
+# AGENTS.md — Web Packages
+
+These rules supplement the package conventions in [packages/AGENTS.md](../AGENTS.md).
+
+- **Reject redirects on credential-bearing provider requests.** Configure the HTTP client to fail before following any redirect response. Regression coverage must prove that the redirect target is not contacted and that every credentialed provider opts into the policy. The configured endpoint necessarily receives the initial request; this prevents automatic forwarding of credentials or request data to another origin, not compromise of the configured endpoint.