diff --git a/.github/workflows/auto-merge-dependabot-prs.yml b/.github/workflows/auto-merge-dependabot-prs.yml
index 63b34d58..618aa9fa 100644
--- a/.github/workflows/auto-merge-dependabot-prs.yml
+++ b/.github/workflows/auto-merge-dependabot-prs.yml
@@ -17,6 +17,9 @@ on:
 #     types: [labeled]
 
 permissions:
+  # for gh pr review
+  pull-requests: write
+  # for gh pr merge
   contents: write
 
 jobs:
diff --git a/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py b/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py
index 9fca6fde..e40befed 100644
--- a/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py
+++ b/spiffworkflow-backend/src/spiffworkflow_backend/routes/process_api_blueprint.py
@@ -213,6 +213,8 @@ def process_data_file_download(
 # {"ref": "refs/heads/main", "repository": {"name": "sample-process-models",
 # "full_name": "sartography/sample-process-models", "private": False .... }}
 # test with: ngrok http 7000
+# or with:
+# npm install -g localtunnel && lt --port 7000 --subdomain oh-so-hot
 # where 7000 is the port the app is running on locally
 def github_webhook_receive(body: dict) -> Response:
     auth_header = request.headers.get("X-Hub-Signature-256")