Security policy: drop two links to docs absent from the public repo - #78
Merged
Conversation
SECURITY.md cited docs/security/SOUP-DEPENDENCY-HANDLING.md for the reachability criteria and docs/security/DEP-CVE-RUNBOOK.md for the step-by-step CVE response. Neither is in the public tree — docs/security/ does not exist on main at all — so both rendered as 404s for the only audience this file has. Keep the substance (the reachability test is already stated inline) and drop the dead pointers. Every remaining reference in the file resolves: docs/SECURITY.md and docs/SERVICE.md are both present. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
wshallwshall
enabled auto-merge (squash)
July 30, 2026 18:28
wshallwshall
added a commit
that referenced
this pull request
Jul 30, 2026
Seven commits landed on main. One file conflicted, .github/SECURITY.md, and both sides had independently fixed the SAME defect: two markdown links into docs/security/, a directory absent from the public repo. main (#78) removed the references outright. This branch converted them to plain text and pointed at docs/SECURITY-DOCS-POLICY.md, a page that exists only on this branch and that the owner ratified precisely so those ~145 withheld-path mentions have somewhere to point instead of naming documents a reader cannot find. Resolution takes both: main's tighter sentence structure (em-dash rather than a parenthetical), and this branch's named document plus the policy pointer. A reader now learns the analysis exists, that it is maintainer-internal, and what they can request -- which is the whole point of the policy page. main's other change to the file, a working security@ address replacing the dead "email the maintainer at the address on the GitHub profile" fallback (#77), came through untouched and is strictly better than what either side had. Note the five docs/ files a review workflow is currently editing were NOT touched by main and remain uncommitted and intact; this merge deliberately stages only the conflicted file. Verified: 0 conflict markers; the new security@ address present; the policy pointer present twice; 4,639 relative links across 414 files resolve.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
.github/SECURITY.mdcited two documents that are not in the public repository:docs/security/SOUP-DEPENDENCY-HANDLING.md— cited as the authority for the reachability criteriadocs/security/DEP-CVE-RUNBOOK.md— cited as the step-by-step CVE responsedocs/security/does not exist onmainat all (547 files underdocs/, none of them undersecurity/), so both links 404 for the only audience aSECURITY.mdhas — an external reporter reading the policy on GitHub.Change
Drop the two dead pointers and keep the substance. The reachability test was already stated inline in the same bullet ("installed in a shipped profile, wired into a running graph, and egress-reachable"), so nothing of value is lost with the link gone.
Every remaining reference in the file now resolves:
docs/SECURITY.mdanddocs/SERVICE.mdare both present onmain.Note for the maintainer
Those files exist in history but not on the public
main, and.gitignoredeliberately excludes several neighbouring/docs/security/*working docs as "local planning/marketing/security working docs". If these two were meant to stay internal, this PR is the whole fix. If they were meant to be published, restoring them is a separate call — I have not moved any content into the public repo.Follow-up to #77.
🤖 Generated with Claude Code