Skip to content

docs: keep product documentation public, relocate engineering material - #1389

Open
Ndevu12 wants to merge 2 commits into
mainfrom
security/relocate-sensitive-docs
Open

docs: keep product documentation public, relocate engineering material#1389
Ndevu12 wants to merge 2 commits into
mainfrom
security/relocate-sensitive-docs

Conversation

@Ndevu12

@Ndevu12 Ndevu12 commented Aug 10, 2026

Copy link
Copy Markdown
Owner

The public repository now carries product and marketing documentation only. Everything removed here
is preserved in the private engineering repository — nothing was discarded. Paired with
Ndevu12/saw#1.

Removed (internal end to end)

docs/ARCHITECTURE.md, docs/SECURITY_ARCHITECTURE.md, docs/RELEASING.md, CLAUDE.md,
.claude/skills/ (8 skills), .claude/settings.json, and public/stayawakebot_architecture.svg,
whose embedded text rendered the internal module layout.

Redacted in place, user-facing content kept

File What came out
README.md detection-technique enumeration, the ## Architecture heading, the provenance rationale note, links to relocated docs, and a real org name in an example
docs/CLI.md the design-rationale appendix
docs/USAGE.md the explanation of what a normal scan does not cover
CONTRIBUTING.md layering rule, module tree, principles, signature and bot authoring steps
prevent/SECURITY_BASELINE.md token hardening and recovery sections
.github/CODEOWNERS rationale comments — the ownership rules are unchanged and still functional

Install, usage, configuration, the CLI reference and licensing are unaffected. docs/PREREQUISITES.md
is untouched and is now linked from the README's documentation list.

Inbound links to relocated files were repaired in CONTRIBUTING.md, docs/CONFIGURATION.md,
docs/CREDENTIAL_HYGIENE.md, docs/USAGE.md and .github/workflows/release.yml, so no dangling
reference remains.

Deliberately left for a follow-up

  • CHANGELOG.md — ~73% of its 172 entries carry internal detail and it belongs in the private
    repo, but removing it breaks .github/scripts/check_changelog_release.py, the pyproject.toml
    sdist allowlist and tests/test_changelog_release.py. It needs a thin public replacement in the
    same change.
  • config/security.yml — its allowlist is a published index of signature IDs and their
    suppression paths, but CI consumes the file, so it is being analysed separately.
  • pyproject.toml sets readme = "README.md", so this trim does not reach PyPI until the next
    release republishes the long description.

The public repository now carries product and marketing documentation
only. Everything removed here is preserved in the private engineering
repository; nothing was discarded.

Removed (internal end to end):
  docs/ARCHITECTURE.md, docs/SECURITY_ARCHITECTURE.md, docs/RELEASING.md,
  CLAUDE.md, .claude/skills/ (8 skills), .claude/settings.json, and
  public/stayawakebot_architecture.svg, whose embedded text rendered the
  internal module layout.

Redacted in place, keeping the user-facing content:
  README.md          detection-technique enumeration, the Architecture
                     heading, the provenance rationale note, links to
                     relocated docs, and a real org name in an example
  docs/CLI.md        the design-rationale appendix
  docs/USAGE.md      the explanation of what a normal scan does not cover
  CONTRIBUTING.md    layering rule, module tree, principles, signature
                     and bot authoring steps
  prevent/SECURITY_BASELINE.md
                     token hardening and recovery sections
  .github/CODEOWNERS rationale comments; the ownership rules are unchanged
                     and still functional

Inbound links to relocated files were repaired in CONTRIBUTING.md,
docs/CONFIGURATION.md, docs/CREDENTIAL_HYGIENE.md, docs/USAGE.md and
.github/workflows/release.yml, so no dangling reference remains.

CHANGELOG.md and config/security.yml are deliberately untouched here.
The changelog needs a thin public replacement in the same change or the
release gate, the sdist allowlist and tests/test_changelog_release.py
break; the allowlist is consumed by CI and is being analysed separately.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant