Copilot instructions for this repository

Flag likely CVE / security-vulnerability fixes

Commits on master are automatically synced to the public mongodb/mongo repository. A security fix that lands on master before the corresponding CVE is disclosed publicly reveals the vulnerability while released versions are still unpatched.

When reviewing a pull request, flag it prominently if it looks like a fix for a security vulnerability or CVE. Signals include:

• The PR, commit message, or linked ticket mentions a CVE, "vulnerability", "security fix", "embargo", or a security-team ticket.
• The change fixes spoofing, forgery, injection, authentication/authorization bypass, privilege escalation, out-of-bounds access, or similar exploitable behavior.
• The change hardens a trust boundary (e.g. validating previously trusted input from the network, a proxy header, or another node) or corrects audit-log attribution.
• Documentation changes that describe how existing behavior can be abused by an attacker.

If any of these apply, add a review comment telling the author:

This PR looks like it may fix a security vulnerability. Because master is synced to the public repository, this change must only be merged after the corresponding CVE has been publicly disclosed and fixed releases are available. Confirm disclosure timing with the security team before merging.

Do not speculate about exploit details in review comments; just flag the disclosure-timing concern.