Remove private repositories from the public status file - #3
Merged
Conversation
status.json lives in a public repository, so every entry in it is readable by anyone. Private repos were tracked here and merely withheld from the rendered output — but the file itself named eleven unreleased privacykey projects, which is the thing the withholding was meant to prevent. Only public repositories belong in a public hub. The rendered project list is unchanged; the tier legend shrinks, because it previously advertised which tiers private repos sat in. Note this does not remove the names from git history. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge this promptly.
status.jsonis in a public repo, so its contents are readable by anyone — and it named eleven private privacykey repositories.The design withheld private repos from the badges and from
STATUS.md, but the source file itself listed them, which defeats the point. My error when I built the hub.Removed:
privacysentinel,handseal,on-country,sentinelcatalogue,pt-mcp,iOSauditor,docs-privacytracker,docs-privacysentinel,website-mantis,website-privacytracker,website-privacycommand.Some carried notes too, e.g. one recorded that a docs site was not live and had no DNS.
What changes
The rendered project list is unchanged — those repos were never listed. The tier legend shrinks, because it previously showed tiers only private repos occupied, which itself leaked their existence.
What this does not fix
The names remain in this repo's git history. Removing them from HEAD stops them being browsable in the current file and keeps them out of future search indexing, but the commit that added them is still there. Fully expunging needs a history rewrite — your call whether that is worth it, given the repo is small and young.
Follow-up
gh-workflows#10 makes the build fail if a private repo ever appears in a public hub again. Merge this one first, or that guard will reject this repo.
🤖 Generated with Claude Code