py/ai-job-search
1
0
Fork 0
mirror of https://github.com/MadsLorentzen/ai-job-search.git synced 2026-09-17 00:26:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(privacy): stop calling a fork 'private working space'; warn at /setup time

Browse Source 
Forks of public GitHub repositories are always public, so SETUP.md
section 8's 'your fork is private working space, so commit them' invited
exactly the personal-data exposure it seemed to rule out - the observed
failure mode behind several real forks that pushed filled-in profiles to
public master. Section 8 now states the fork-is-public fact plainly and
documents the safe alternative (private repo + template as upstream
remote), and /setup's completion summary carries a matching privacy note
at the exact moment profile data first lands in tracked files.

Also backfills the CHANGELOG entry for #265.

Prompted by rasstamann's discussion #266.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mads Lorentzen
2026-08-01 22:03:22 +02:00
co-authored by Claude Fable 5
parent 72bbe00529
commit d4b406efff
3 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+13
View File
@@ -25,6 +25,13 @@ per-file diff commands.
### Security & privacy
- **SETUP.md no longer calls a fork "private working space"** - forks of public GitHub
repositories are always public, so that wording invited exactly the personal-data
exposure it seemed to rule out. Section 8 now states the fork-is-public fact plainly and
documents the safe alternative (a private repository with this repo as `upstream`), and
`/setup` ends with a matching privacy note the moment profile data first lands in
tracked files. Prompted by
[discussion #266](https://github.com/MadsLorentzen/ai-job-search/discussions/266).
- **The gitignore guard now covers two more personal-data rules** - `security_guards.py`
requires `cover_letters/Cover_*.*` (the uppercase cover-letter naming variant `/apply`
recognizes) and `cv/*.txt` (ATS text extractions of tailored CVs) in `.gitignore`, so a
@@ -33,6 +40,12 @@ per-file diff commands.
### Fixed
- `tools/check_upstream_updates.py` no longer reports a false "up to date with upstream"
when it silently falls back to a fork's own `origin` remote - the default state of a
plain fork clone, where the script compared the fork against itself and could never
detect upstream updates. It now warns that the fallback remote is not the template repo,
shows the `git remote add upstream` command to fix it, and names the ref it actually
compared against. (#265)
- Removed the vestigial `cover_letters/OpenFonts/cover.cls` - an unreferenced remnant of
the original font bundle that, since #252's class rename, ambiguously declared the same
`cover` class as the real `cover_letters/cover.cls`.