From 0c4f7b3d4374d076cded459a83ffd8b592ca1a60 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Sat, 28 Mar 2026 19:48:32 +0000 Subject: [PATCH] docs(security): localize shipped doc self-link --- SECURITY.md | 2 +- .../v6/internal/subsystems/security-privacy.md | 4 ++++ frontend-modern/public/docs/SECURITY.md | 2 +- frontend-modern/src/stores/__tests__/systemSettings.test.ts | 5 +++++ frontend-modern/src/utils/__tests__/docsLinks.test.ts | 1 + 5 files changed, 12 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 2797ae1982..1d6be546fc 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -111,7 +111,7 @@ Verify temperature collection is agent-based: journalctl -u pulse-agent -n 200 --no-pager ``` -**Documentation:** +**Documentation:** [Critical security notice for container deployments](#critical-security-notice-for-container-deployments) **Issues:** **Private disclosures:** diff --git a/docs/release-control/v6/internal/subsystems/security-privacy.md b/docs/release-control/v6/internal/subsystems/security-privacy.md index f8871cc93d..6dd59b730f 100644 --- a/docs/release-control/v6/internal/subsystems/security-privacy.md +++ b/docs/release-control/v6/internal/subsystems/security-privacy.md @@ -125,6 +125,10 @@ owner for privacy-document URLs, while `frontend-modern/public/docs/PRIVACY.md` is the version-matched asset served by the running build. Privacy disclosures must not drift back to GitHub `main` links that can describe a different revision than the installed runtime. +That same rule also applies inside shipped security guidance itself: +`SECURITY.md` and the synced `frontend-modern/public/docs/SECURITY.md` copy may +not bounce the operator back to GitHub `main` for section references that the +running build already owns locally. That same governed settings trust boundary now also includes `frontend-modern/src/components/Settings/QuickSecuritySetup.tsx`, `frontend-modern/src/components/Settings/SecurityPostureSummary.tsx`, diff --git a/frontend-modern/public/docs/SECURITY.md b/frontend-modern/public/docs/SECURITY.md index 2797ae1982..1d6be546fc 100644 --- a/frontend-modern/public/docs/SECURITY.md +++ b/frontend-modern/public/docs/SECURITY.md @@ -111,7 +111,7 @@ Verify temperature collection is agent-based: journalctl -u pulse-agent -n 200 --no-pager ``` -**Documentation:** +**Documentation:** [Critical security notice for container deployments](#critical-security-notice-for-container-deployments) **Issues:** **Private disclosures:** diff --git a/frontend-modern/src/stores/__tests__/systemSettings.test.ts b/frontend-modern/src/stores/__tests__/systemSettings.test.ts index dfe3f91cd8..7b7f8fbca6 100644 --- a/frontend-modern/src/stores/__tests__/systemSettings.test.ts +++ b/frontend-modern/src/stores/__tests__/systemSettings.test.ts @@ -1,4 +1,5 @@ import { beforeEach, describe, expect, it } from 'vitest'; +import { PRIVACY_DOC_URL } from '@/utils/docsLinks'; import { areSystemSettingsLoaded, markSystemSettingsLoadedWithDefaults, @@ -51,4 +52,8 @@ describe('systemSettings store', () => { expect(shouldDisableLocalUpgradeMetrics()).toBe(false); }); + it('keeps the telemetry disclosure on the shipped local privacy doc', () => { + expect(PRIVACY_DOC_URL).toBe('/docs/PRIVACY.md'); + }); + }); diff --git a/frontend-modern/src/utils/__tests__/docsLinks.test.ts b/frontend-modern/src/utils/__tests__/docsLinks.test.ts index 0a49b863c0..b445083f34 100644 --- a/frontend-modern/src/utils/__tests__/docsLinks.test.ts +++ b/frontend-modern/src/utils/__tests__/docsLinks.test.ts @@ -47,6 +47,7 @@ describe('docsLinks', () => { const rootDoc = readFileSync(source, 'utf8'); const publicDoc = readFileSync(path.join(frontendRoot, 'public', 'docs', target), 'utf8'); expect(publicDoc).toBe(rootDoc); + expect(publicDoc).not.toContain('https://github.com/rcourtman/Pulse/blob/main/'); } });