> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase15-session06-cross-linking-and-copy-consistency-pass/security-compliance.md). # Security & Compliance Report **Session ID**: `phase15-session06-cross-linking-and-copy-consistency-pass` **Package**: `public-website` **Reviewed**: 2026-06-02 **Result**: PASS *** ## Scope **Files reviewed** (session deliverables only): * `public-website/package.json` - package-local validation script wiring. * `public-website/src/data/site.ts` - shared route, destination, proof-point, and guardrail constants. * `public-website/src/data/navigation.ts` - primary, footer, and mobile navigation data. * `public-website/src/components/navigation/Header.astro` - primary navigation rendering and focus behavior. * `public-website/src/components/navigation/MobileNavigation.astro` - mobile navigation rendering and accessibility behavior. * `public-website/src/components/navigation/Footer.astro` - footer link rendering and layout behavior. * `public-website/src/data/homepage.ts` - homepage proof points and CTA copy. * `public-website/src/data/product.ts` - product proof points and boundary copy. * `public-website/src/data/features.ts` - features and how-it-works copy. * `public-website/src/data/security.ts` - security, privacy, and boundary copy. * `public-website/src/data/use-cases.ts` - use-case copy and route links. * `public-website/src/data/company.ts` - company, investor, contact, and press copy. * `public-website/src/data/roadmap.ts` - roadmap route links and no-date copy. * `public-website/src/data/faq.ts` - FAQ route links and hosted-option answers. * `public-website/src/content/blog/*.md` - blog cross-links and guarded product claims. * `public-website/src/content/news/*.md` - news cross-links and guarded product claims. * `public-website/src/pages/blog/index.astro` - blog index route metadata and links. * `public-website/src/pages/news/index.astro` - news index route metadata and links. * `public-website/src/pages/legal/index.astro` - legal hub review markers and policy links. * `public-website/src/pages/legal/privacy.astro` - privacy placeholder and review markers. * `public-website/src/pages/legal/terms.astro` - terms placeholder and review markers. * `public-website/src/pages/legal/acceptable-use.astro` - acceptable-use placeholder and review markers. * `scripts/check-public-website-links.mjs` - deterministic static-site validation checker. **Review method**: Static analysis of session deliverables plus package typecheck/build and built-site checker verification. *** ## Security Assessment ### Overall: PASS | Category | Status | Severity | Details | | ----------------------------- | ------ | -------- | ----------------------------------------------------------------------------------------------------------- | | Injection (SQLi, CMDi, LDAPi) | PASS | -- | No query construction or shell execution was introduced in the public website deliverables. | | Hardcoded Secrets | PASS | -- | No credentials, tokens, or secret material were added. | | Sensitive Data Exposure | PASS | -- | The session stays on static marketing content and does not add data capture, logs, or storage. | | Insecure Dependencies | PASS | -- | No new production dependencies were added. | | Misconfiguration | PASS | -- | The site remains static Astro output with no server adapter, hosted form workflow, or analytics enablement. | ### GDPR Compliance | Category | Status | Severity | Details | | ------------------- | ------ | -------- | ------------------------------------------------------------------- | | Data Collection | N/A | -- | No new visitor data collection or personal-data pipeline was added. | | Consent | N/A | -- | No new consent or policy-acceptance flow was introduced. | | Data Minimization | N/A | -- | No new personal data collection was added. | | Right to Erasure | N/A | -- | No new storage or retention path was introduced. | | Data Logging | N/A | -- | No personal data logging was introduced. | | Third-Party Sharing | N/A | -- | The session does not send user data to external services. | *** ## Behavioral Quality Spot-Check **Result**: PASS The session deliverables are static content, navigation, and validation plumbing. They do not add trust-boundary regressions, mutable client state, unsupported external execution, or contract drift. The static checker explicitly guards the approved external destinations and the no-claim copy boundaries. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase15-session06-cross-linking-and-copy-consistency-pass/security-compliance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.