Keeping working notes beside website files is convenient. Uploading that directory wholesale can also publish those notes. I reread a handoff recording this failure and checked the boundaries between source material, working documents and public output in this site.
An unlinked file can still have a public request path
A file does not become private merely because there is no menu item or link to it. If included in static output, it can be requested directly when its name is known or another record retains the address. An earlier handoff explains moving working documents and generation records outside the site folder for this reason. Interface visibility and file-serving boundaries are different conditions.
The historical record says exclusion and redirect attempts did not hide those files as expected in that particular deployment. I do not generalize that observation into a rule for every current host. Establish which files the actual deployment contract uploads, then place unpublished material outside that boundary rather than relying on an ambiguous attempt to hide an uploaded asset.
Separate source material from public build output
Source work needs instructions, checks, originals and private evidence. Public output needs the visitor-facing pages and approved assets. This site selectively copies the required files into an output directory, and its deployer constructs the asset manifest from there. Avoiding a wholesale project upload provides an initial structural boundary against accidental exposure.
I inspected the current fifty-two upload-candidate paths for working-document folders, private material, Python helpers and notes. Server entry files and server-only modules are excluded from the static manifest and bundled separately. The inspection follows the actual upload contract rather than assuming every source file beside output must be a public static asset.
Inspect paths, content and actual responses separately
Renaming a folder does not remove secrets or customer identifiers from its contents. Automated checks help locate known markers in paths and text. Identity inside images, video and documents still needs review tied to exact approved bytes. Failure to detect a known marker should not be presented as completion of every privacy review.
For this site I checked not-found responses at seven selected private paths and rejection of the management list without authentication. Those are current responses for the specified routes, not an inspection of every address and storage system. Manifest inspection and response checks complement each other, with each retaining its own bounded evidence.
Connect downloadable material to current published content
The extensible editor can place images, video, PDFs and files in a dedicated media library. Upload alone is not treated as publication. Delivery depends on readiness, public review and reference from current published content. With shared material, withdrawing one article may still leave an asset public through another published reference; that relationship needs to remain explicit.
The new logo article references three reviewed anonymous SVGs whose public hashes and formats were checked after publication. Original customer logos and PDFs were not uploaded. Beyond neutral filenames and descriptions, the check establishes which actual bytes are being served. Content visibility and asset visibility remain connected instead of becoming unrelated labels.
Retain the failure privately and publish the transferable method
A document recording failure can be valuable for subsequent work. Retain it as private evidence rather than deleting the lesson, then author a fresh explanation of the decision and checks for publication. The upload-versus-direct-address distinction can be taught without exposing customer names, other website addresses or internal paths.
Current verification covers the local asset candidate list, selected HTTP paths and management authentication boundary. It did not inspect a new browser screen, OCR every medium or investigate exposure in every historical deployment. I retain continuity documents through a different path from files offered to visitors. As editing capability expands, preserving that distinction remains part of the expansion contract.