Harden browser docs and transport recovery

tools/docs_check.py

@@ -8,6 +8,26 @@ from pathlib import Path
 ROOT = Path(__file__).resolve().parents[1]
 IGNORED_PARTS = {".git", "__pycache__", "generated", "private"}
 LINK_RE = re.compile(r"\[[^\]]+\]\(([^)]+)\)")
+FORBIDDEN_PUBLIC_TERMS = (
+    "wowrace",
+    "wowngeon",
+    "smirk-monorepo",
+    "medusa-multi-tenant-platform",
+    "ai-gen-bot",
+)
+SECRET_PATTERNS = (
+    ("private key block", re.compile(r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----")),
+    ("open ssh private key block", re.compile(r"-----BEGIN OPENSSH PRIVATE KEY-----")),
+    ("aws access key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
+    ("github token", re.compile(r"\bgh[pousr]_[A-Za-z0-9_]{20,}\b")),
+    ("slack token", re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}\b")),
+    (
+        "assigned secret",
+        re.compile(
+            r"(?i)\b(api[_-]?key|secret|password|token)\s*=\s*['\"][^'\"]{8,}['\"]"
+        ),
+    ),
+)
 
 
 def main() -> int:
@@ -17,6 +37,13 @@ def main() -> int:
         rel = path.relative_to(ROOT)
         if not _has_status_header(text):
             failures.append(f"{rel}: missing status header in first six lines")
+        lower_text = text.lower()
+        for term in FORBIDDEN_PUBLIC_TERMS:
+            if term in lower_text:
+                failures.append(f"{rel}: public docs contain private target term {term!r}")
+        for label, pattern in SECRET_PATTERNS:
+            if pattern.search(text):
+                failures.append(f"{rel}: public docs may contain {label}")
         failures.extend(_broken_links(path, text))
     if failures:
         for failure in failures: