docs: correct drift against privacytracker main - #2
Merged
Conversation
added 2 commits
August 7, 2026 13:09
Verified every claim below against the privacytracker tree at origin/main. Configuration - Document the network-exposure env vars, which were entirely absent: PRIVACYTRACKER_ALLOWED_HOSTS, _NETWORK_EXPOSED, _TRUST_PROXY, _BIND_HOST. The page previously listed three variables and asserted "that's the entire surface area", so anyone exposing an instance beyond loopback had no documentation for the Host allowlist that blocks them, or for the admin token becoming mandatory once it is exposed. - Document PRIVACYTRACKER_DATA_DIR, PRIVACYTRACKER_RUNTIME and WORKER_DISABLED. - Drop NODE_V8_COVERAGE from the product config table; it is a Node flag. - Chinese ships. locales/zh.json is at full key parity with en.json (4763 keys) and i18n.ts declares SUPPORTED_LOCALES = ["en", "zh"], but the page claimed English only. Also correct the locale source: it resolves from the NEXT_LOCALE cookie, not from app settings. Hardening / Tauri - AUDITOR_DISABLE_AUTO_UPDATE does not exist anywhere in the codebase. The hardening guide told Tier 3 operators to set it in a launchd plist, which silently does nothing. Replace with the real position: the updater plugin is registered unconditionally and plugins.updater.active is true, so there is no opt-out — the workarounds are running Docker or blocking the update endpoint. Feature flags - The module table listed five modules; seven exist. Add feature-flag-usage.ts and feature-flag-wired.ts, noting neither affects resolution. Dead references - tools/ios-app-import/ -> scripts/ios-app-import/ (9 occurrences; the repo has no tools/ directory, so the cookbook's "clone just that directory" link 404s). - SECURITY.md -> .github/SECURITY.md. - tests/setup-env.ts -> tests/helpers/setup-env.ts. - tests/profile-presets.test.ts -> tests/app/profile-presets.test.ts. - tests/scraper.test.ts -> tests/app/scraper-fixture.test.ts, and describe the pattern that file actually uses (fetch stubbed against an in-file payload); there is no tests/fixtures/scraper/ directory to drop captures into.
The Plausible integration domain and three README/CONTRIBUTING links pointed at docs.privacytracker.io, which is neither the agreed scheme nor a domain that resolves. The convention across the estate is docs.<product>.privacykey.org — docs-privacysentinel already uses it.
Devices shipped with no page at all — a settings screen, a two-phase re-sync diff, and cfgutil backup/uninstall, none of it written down. Added under Get Started, after Configuration. Sourced from lib/devices.ts, lib/device-sync.ts, lib/device-actions.ts, the nine device API routes, and the devices.* strings in locales/en.json. Two things worth having in writing: - Orphaning. Removing an app from its only device untracks it entirely and takes its history with it. The diff flags every such row with wouldOrphan, and the same sweep runs on device delete. Nobody could learn that from the docs before doing it. - The uninstall gates. Audience must be self, flag.devopts.cfgutil_uninstall must be on (off by default), and a backup must be under 24h old. The audience gate is a deliberate product position — guardian mode cannot reach across and remove apps from a supervised device — and it deserved to be stated rather than left in a source comment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit of every page against the privacytracker tree at
origin/main. Each item below was verified in the source, not inferred.Wrong, not just stale
AUDITOR_DISABLE_AUTO_UPDATEdoes not exist.hardening.mdxtold Tier 3 operators to set it in a launchd plist to stop the desktop auto-updater. There is no such variable anywhere in the codebase — the updater plugin is registered unconditionally insrc-tauri/src/main.rsandplugins.updater.activeistrue. An operator following that guide gets a plist entry that does nothing and believes updates are off. Replaced with the two workarounds that do work (run Docker on those hosts, or block the update endpoint).The env var table was missing the entire network-exposure surface. It listed three variables and stated "that's the entire surface area".
PRIVACYTRACKER_ALLOWED_HOSTS,PRIVACYTRACKER_NETWORK_EXPOSED,PRIVACYTRACKER_TRUST_PROXYandPRIVACYTRACKER_BIND_HOSTwere undocumented — so someone putting the app on a LAN had nothing explaining why the browser cannot load it (Host allowlist), or thatAUDITOR_ADMIN_TOKENbecomes mandatory once a non-loopback host is listed. Semantics taken fromlib/deployment-trust.ts.Chinese ships, and the docs said it doesn't.
locales/zh.jsonis at exact key parity withen.json(4763 keys each) andi18n.tsdeclaresSUPPORTED_LOCALES = ["en", "zh"]. The page said "today that means English only". Also corrected the resolution mechanism — the locale comes from theNEXT_LOCALEcookie, not from app settings.Stale references
tools/ios-app-import/×9scripts/ios-app-import/— there is notools/directory, so the cookbook's "clone just that directory" link 404sblob/main/SECURITY.mdblob/main/.github/SECURITY.mdtests/setup-env.tstests/helpers/setup-env.tstests/profile-presets.test.tstests/app/profile-presets.test.tstests/scraper.test.tstests/app/scraper-fixture.test.tsThe scraper entry also had the wrong workflow: it told contributors to drop captured payloads into
tests/fixtures/scraper/, which does not exist. The real pattern stubsglobal.fetchagainst an in-file payload.Incomplete
develop/feature-flags.mdxdescribed a "five-module split" under a warning not to break the layering. Seven modules exist —feature-flag-usage.tsandfeature-flag-wired.tswere missing. Both are Developer-Options-only and affect nothing in resolution, which the new rows say explicitly.Verification
node scripts/check-docs.mjspasses (39 linked files).Not addressed here — needs a decision
privacykey/pt-mcp(@privacytracker/mcp) registers 11 tools, its own README documents 4, and the package is not published to npm — so thenpx -y @privacytracker/mcpinstruction in that README does not work. Documenting it here first needs the publish question settled./dashboard/settings/devicesplus 11 API routes (/api/devices/*,/api/device-sync/*,/api/device-actions/*) ship today with no prose page and no OpenAPI coverage.