The home module's social-proof defaults hardcode a real-looking external brand + domain (and a second real-looking domain) as shipped defaults of this public stack — a generic-OSS hygiene violation (defaults must not reference a real third party).
Blast radius — 6 occurrence-pairs across 3 files (verified):
src/config/index.js (the bundled runtime default — the one that actually ships)src/modules/home/config/home.development.config.js (module config source)src/modules/home/components/home.social.component.vue (component default + comment example)
A component-only fix would close this while the bundled src/config/index.js keeps shipping the real domain — a half-fix. Fix all sites.
Proposed:
- Replace every occurrence with an RFC-2606 reserved placeholder (
Example Co / https://example.com) — never trade one real domain for another.
- If
src/config/index.js is generated from src/config/defaults/*, fix the source + regenerate (don't hand-edit the built file).
- Add a CI/
/verify grep-guard for hardcoded real brand/domain literals so it can't recur.
- The same contamination class also appears in
lib/helpers/api.js:11 (comment) + an api.unit.tests.js fixture — fold into this checklist or file a sibling.
Split from a docs-cleanliness audit (a sibling issue), 2026-06-16. Public-OSS hygiene — ship promptly.
The home module's social-proof defaults hardcode a real-looking external brand + domain (and a second real-looking domain) as shipped defaults of this public stack — a generic-OSS hygiene violation (defaults must not reference a real third party).
Blast radius — 6 occurrence-pairs across 3 files (verified):
src/config/index.js(the bundled runtime default — the one that actually ships)src/modules/home/config/home.development.config.js(module config source)src/modules/home/components/home.social.component.vue(component default + comment example)A component-only fix would close this while the bundled
src/config/index.jskeeps shipping the real domain — a half-fix. Fix all sites.Proposed:
Example Co/https://example.com) — never trade one real domain for another.src/config/index.jsis generated fromsrc/config/defaults/*, fix the source + regenerate (don't hand-edit the built file)./verifygrep-guard for hardcoded real brand/domain literals so it can't recur.lib/helpers/api.js:11(comment) + anapi.unit.tests.jsfixture — fold into this checklist or file a sibling.Split from a docs-cleanliness audit (a sibling issue), 2026-06-16. Public-OSS hygiene — ship promptly.