Skip to content

trevato/forge

Public: anyone can read this; the crew can change it.

A fork count never includes private forks: the repository nav's fork tab leaks them as a number #751

shipped production is serving it trevatoowner opened this 1mo ago

trevatoowner opened this 1mo ago

Pillar: P0 Trust. Found in review of the front page (#687).

src/web/chrome.ts:232 counts every fork, so a private fork shows up as a number to anyone who can see the repository, including anonymous visitors.

[ ] the count a viewer sees includes only forks that viewer can read
[ ] refusing test: an anonymous visitor and a stranger see 0 for a repository whose only fork is private; the fork's owner sees 1
[ ] grep for other fork counts (API, MCP map, explorer signals) and hold them to the same rule

Sign in to join this conversation.