Every URL we publish now resolves — seven didn't - #287
Merged
Merged
Conversation
Reviewed the docs the way a launch does: by following the links rather than reading them. Seven were broken, and the two that matter are not documentation problems. security.txt advertised a policy page that has never existed. Policy: https://sentinel-command.com/security#vulnerability-disclosure 404, along with every plausible variant. security.txt is machine-read under RFC 9116 — a researcher fetches it, follows Policy:, and decides whether they are covered before touching anything. Ours led to nothing, so we published no scope and, more importantly, no safe harbour. The authorisation language that keeps good-faith research out of CFAA territory was unreachable at the exact moment someone needed it. SECURITY.md compounded it by calling that page "canonical when the two disagree", so the complete policy sitting in this repo was formally subordinate to a 404. It now points at itself, and security.txt points at it. The test that should have caught this asserted the Policy: line was PRESENT. A well-formed pointer at nothing passes that. Worse, its docstring described an id="vulnerability-disclosure" section on a page that was never built — a test pinning a fiction. It now pins the specific target, so moving it is deliberate and comes with a test to update. The launch checklist gave operators a webhook URL that 404s. Clerk and Resend were to be configured against sentinel-command.com/api/webhooks/*. The apex is the marketing site; the API is on app.sentinel-command.com. Configuring what was written means every membership, billing and delivery webhook fails silently — nothing errors, events simply never arrive — and it fails at launch, during the window where org and billing state matters most. Same apex/app confusion hit the on-call runbook's Quick reference table, where /api/health is the first thing a responder runs, and the disaster recovery runbook's readiness probe. Eight URLs corrected across four files; all verified 200 (or 405 on a POST-only webhook, which is the endpoint answering correctly). Also fixed in SECURITY.md, a customer-facing document: it called the product "SourceBox Sentry" twice, two brand names ago, and told reporters /api/health returns a commit. It returns a version. 864 tests pass, ruff clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reviewed the docs the way a launch does: by following the links rather than reading them. Seven were broken, and the two that matter aren't documentation problems.
1.
security.txtadvertised a policy page that has never existed404 — along with every plausible variant I probed.
security.txtis machine-read under RFC 9116. A researcher fetches it, followsPolicy:, and decides whether they're covered before touching anything. Ours led to nothing, so we published no scope and — the part with teeth — no safe harbour. The authorisation language that keeps good-faith research out of CFAA territory was unreachable at exactly the moment someone needed it.SECURITY.mdcompounded it by calling that page "canonical when the two disagree", making the complete policy sitting in this repo formally subordinate to a 404. It now points at itself, andsecurity.txtpoints at it.The test that should have caught this asserted the
Policy:line was present — a well-formed pointer at nothing passes that. Its docstring even described anid="vulnerability-disclosure"section on a page that was never built. It now pins the specific target.2. The launch checklist gave operators a webhook URL that 404s
LAUNCH_HANDOFF.mdhad Clerk and Resend configured againstsentinel-command.com/api/webhooks/*. The apex is the marketing site; the API is onapp.sentinel-command.com.Configuring what was written means every membership, billing, and delivery webhook fails silently — nothing errors, events just never arrive — and it fails at launch, in the window where org and billing state matters most.
The rest
Same apex/app confusion in:
ON_CALL.md's Quick reference table, where/api/healthis the first thing a responder runsDISASTER_RECOVERY.md's readiness probeREADME.md's docs linkEight URLs corrected across four files, all verified 200 (or 405 on the POST-only webhook — the endpoint answering correctly).
Also in
SECURITY.md, a customer-facing document: it called the product "SourceBox Sentry" twice, two brand names ago, and told reporters/api/healthreturns a commit. It returns a version.864 tests pass, ruff clean.
🤖 Generated with Claude Code