Fix the Walk & Test privacy disclosure, and pin it with a test - #8
Merged
Conversation
The in-app disclosure list still named www.facebook.com and omitted www.atlassian.com after the destination swap. The README table was updated in that commit; the modal was not. So the app was telling users it contacts a host it no longer touches, and not telling them about one it does. The list is a contract, and the rule that a new probe endpoint gets disclosed in the same commit is enforced by discipline alone, which is how it slipped: prose does not typecheck. Adds PrivacySafetyModal.test.ts, which does. Every WALK_TARGETS host and every FAMILY_ENDPOINTS host must appear in the disclosures, no removed host may still appear, and every row must actually say what its host receives. Both directions matter: a missing host understates what leaves the browser, and a stale one erodes the list's credibility until nobody reads it. Also corrects the request-volume figure, which predated the one-second interval option and understated the busiest case.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while verifying the #7 deployment against the live bundle.
The bug
After swapping Facebook for Atlassian, the in-app disclosure list still named
www.facebook.comand omittedwww.atlassian.com. The README privacy table was updated in that commit;THIRD_PARTY_DISCLOSURESwas not.So the app was telling users it contacts a host it no longer touches, and not telling them about one it does. Both halves are wrong, and the second is the serious one.
Why it slipped
The disclosure list is a contract, and
CLAUDE.mdstates the rule plainly: a new probe endpoint gets disclosed in the same commit. That rule was enforced by discipline alone, and prose does not typecheck.The fix
Corrects the row, and adds
src/components/PrivacySafetyModal.test.tsso the next drift fails instead of shipping:WALK_TARGETShost appears in the disclosuresFAMILY_ENDPOINTShost appears in the disclosuresBoth directions are checked on purpose. A missing host understates what leaves the browser. A stale host overstates it, which is the kind of error that quietly erodes the list until nobody bothers reading it.
Also corrects the request-volume figure in that row, which predated the one-second interval and understated the busiest case.
Verification
npm run checkgreen: 313 tests, 5 new. Confirmed the new test fails against the pre-fix disclosure list before fixing it.Generated by Claude Code