A sitemap mixes private and public routes

What to change

Automatic file discovery needs an explicit public-content rule. Ask the supplier how it distinguishes published articles from previews, tests and restricted resources, then challenge that rule with representative examples. The content owner should approve intentional exclusions. Keep access protection separate: a resource can be absent from a sitemap and still publicly retrievable. Acceptance therefore needs both a correct public inventory and unchanged protection of restricted material.

A worked example

Illustrative example

Illustrative test: Place an intentionally private fixture in the source tree during a controlled test.

How to check the result

The fixture stays out of the public sitemap without weakening its access protection.

A mistake to avoid

Sitemap exclusion alone does not secure a private file.

Your action checklist

Use these checks to prepare a discussion with your team or supplier. Tick a check when you have recorded the decision or evidence, rather than when a feature has simply been promised.

Decisions to recordList routes excluded by access or indexing policy.Compare those exclusions with the generator's file-walking rules.Test a representative restricted route against the generated inventory.

Evidence, open questions and decisionsNext action and responsible role

Entries stay in this page and are not submitted to Kay & Co. Download your notes before leaving; the page does not save them.