carlos / platform Public

| Previous finding | Disposition | Evidence | |---|---|---| | 1. P1 — Encoded addresses and private links bypass validation | Not fully fixed | [source](https://github.com/carlosframework/public/../platform.git) still passes the website checker when rendered in memory. The browser normalizes its destination to the private repository’s clone URL. Go normalization removes /./ but leaves /../, so its private-repository pattern misses this input. The website pattern checks the normalized path but misses the .git suffix. Remaining fix: normalize complete URL paths in Go and recognize optional .git repository suffixes in both validators; add this regression case. |

No new P1 or P2 findings. This remaining bypass belongs to finding 1.

Correction to round 2: ops**@**example.org renders literally. The valid split-address example **ops@example**.org is now rejected, as is the original /./platform URL.

Reviewed platform 08467448 and website 1fa82b9. All 28 release ranges and 363 unique changes’ own-commit counts match Git; vendored data matches. Existing website checks and in-memory rendering ran. Go tests could not start because the sandbox prevents creating their work directory; full npm run check requires writes. No files edited.

accept with fixes