Private and public outputs
Public artifacts must contain only approved public bytes. Hidden navigation, unlinked pages and obscure URLs do not protect HTML/search/copied resources.
Separate all inputs
| Input | Disclosure risk |
|---|---|
| Markdown | Body, metadata and search text |
| Static resources | Independently copied images/downloads |
| Templates | Embedded identity, links or scripts |
| Configuration | Public URLs/descriptions/HTML policy |
| Runtime settings | Effective branding/header links |
| Icons | Retained cached icon bytes |
| Host leftovers | Removed content from add-only upload |
Two Markdown trees alone are insufficient if builds share private static/templates/runtime. Prefer separate reviewed project copies. Keep private account/runtime storage outside publishable inputs/output.
Public build
In a disposable installed engine whose static/templates/siteconfig are reviewed as public:
node build.js --content ./public-docs --out ./public-output --data ./public-data
These are builder flags, not general editor source/output flags. Paths resolve from working directory. Review absolute output target: build recreates it. public-data must be deliberately separate, not a renamed private runtime backup.
This still uses the engine installation’s static/templates/siteconfig. Missing runtime files do not sanitize configured branding/resources. Inspect effective output, not directory names. For private output use distinct reviewed inputs and a target never synchronized publicly. Site URL/base prefix is not privacy or automatic authored-link rewriting.
Inspect and deploy
- Inventory generated paths and every copied asset/download/icon.
- Read actual search JSON as well as visible pages.
- Check confidential phrases/identities/accounts/embedded metadata.
- Verify downloaded bytes/type, not filename or HTTP 200 alone.
- Decide whether direct hidden/unlinked routes belong.
- Reconcile removed inputs with old-host removal plan.
Phrase scans are aids, not proof. PDF/image bytes can contain material outside Markdown and exports can retain metadata. Build success is not privacy review.
| Target | Required gate |
|---|---|
| Public host | Public-approved artifact only |
| Private host | Actual reader authentication/network gate |
| Writer | Separate account/source boundary |
| Recovery | Private storage and tested restore |
Verify account/project/branch/domain before upload. Wrong destination can disclose a complete internal handbook. Deploy output, not whole checkout. Test private access on search/icons/media/downloads and from an unauthorized reader context. Editor login does not protect static output.
Remove exposed material
Remove source and copied static input, rebuild and remove old host bytes using supported provider process. Recheck direct URLs/caches. Hiding a link is insufficient; add-only upload can retain obsolete files.
For exposed credentials/protected information use real incident/revocation process. Markdown replacement alone is not guaranteed remediation. Preserve evidence privately. Security and privacy, Review and release and Static deployment explain the gates; no built-in public/private filtering is claimed.