Add CLAUDE.md pointing at the private operational notes - #23
Merged
Conversation
Records where the operational and security notes live, and that they are read before work starts rather than consulted afterwards. Carries only what is safe to state publicly: the two failure modes that break the live site, the load-bearing CSP directive, and the single-key rule. Which controls are and are not in force stays in the private repository.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Records where the operational and security notes live, so work on this repository starts by reading them rather than rediscovering the same things.
The notes are in
zerotrustdavid/invision-security-notes, which is private. That repository carries the protocol in full; this file is the pointer to it.What is in the file
Only what is safe to state in a public repository:
NEXT_PUBLIC_values needing a redeploy, and the Web3Forms captcha toggle rejecting every submission because the forms send no tokenconnect-src 'self' https://api.web3forms.comsrc/lib/mailboxes.ts, and why the?? FALLBACKchain must not come backWhat is deliberately not in it
Which security controls are and are not currently in force. That belongs in the private repository and stays there. This file states that the repository is public and that such detail does not go in it.
Note on the trade-off
This names a private repository in a public one. Nobody gains access from that, they only learn it exists. The alternative was gesturing at it without naming it, which would leave a session unable to act without asking first. The explicit pointer was chosen deliberately so the protocol works unattended.
No code or configuration changes. Documentation only.