LLL Public URL Collision Audit

FAQ

What does a collision mean? Distinct CMS record identities resolve to exactly the same absolute HTTP(S) URL. Collection/ID/locale/title are shown. Review the configuration yourself: a repeated URL is not necessarily wrong.

Are URLs normalized or fetched? No. Case/slash/query/fragment variants are not merged. No external requests, redirects,404/SEO/canonical checks or content writes.

Which records? CMS-published records in visible routable collections, including public noindex. Drafts/hidden/nonroutable are excluded. Theme-specific protection is not detected. getPublicUrl must resolve; EmDash site public URL and Astro/collection routes need separate setup.

What if there are no rows? No exact collisions were found among checked supported records.200examined maximum,5/step; unresolved URLs and limits produce partial results. It does not clear unscanned data. Rerun after changes; no fixed snapshot.

Where is the report? Plugin KV stores URL/identity/title, not body. One report/user logically expires24h after Start; state is deleted on next read or Clear. No background cleanup guarantee. URLs2048bytes/state512KiB limits. No CSV/download.

Is it paid? This workflow is free; no paid edition is sold. Host runner costs are separate. No external key/account needed. Support/security:contact@lx3.cafe, redacted examples only.

日本語:重複は確認候補で、不正やSEO問題と断定しません。未解決/上限は部分結果。本文変更・通信なし、無料です。

Security

LLL Inc. / MIT / contact@lx3.cafe. Version0.1.0. Scope and data-handling boundaries are described below.

Only content:read/schema:read. One POST JSON admin route requires plugins:manage and host caller identity. No public report route, network, hooks, cron, body/SEO/redirect writes or credentials. User namespaces and revisionCAS protect stored reports and stale Clear operations.

Report metadata (public URL, collection/ID/locale/title) can still be sensitive. The CMS's published state does not prove custom theme access is public. Review the scope before scanning. No article body is stored. One report/user,24h logical expiry; next read/Clear deletes state. There is no scheduled physical cleanup. Browser/user copies are outside plugin deletion control.

Boundaries:200examined/5per step/2048UTF8 URLbytes/512KiBstate; partial on unresolved URLs or limits. Unsafe/userinfo/control URLs are not shown as active links. Output is plain table/text, not executable HTML. No automatic repair, external fetching or CSV export.

Email security issues privately with version and redacted reproduction. Do not send tokens, full exports or private URLs; arrange sensitive evidence sharing first. No response-time commitment is offered.

Changelog

0.1.0

Initial small read-only audit: exact resolved public URL collision review across collections; manual batches; English/Japanese admin UI; scoped report storage and partial-result warnings. No changes to content or routing.

Installation

Version0.1.0. Requires EmDash1.4.0 and official sandbox runner: Node/workerd or supported Cloudflare paid Worker Loader. Hosting costs are separate. Use a validated Registry release, check publisher/signature and content:read/schema:read only, install as administrator, then open Public URL Collisions.

Configure EmDash site public URL separately from Astro site/routes and collection patterns. Start, then Continue manually. Visible routable collections and published records, including public noindex, are checked. Custom theme protection cannot be inferred; review whether the scope is appropriate.

Results show URL, collection/ID, locale and title for distinct records with identical resolved URL strings.20rows/page, unique Next/Previous controls. No collision row is not a site-wide all-clear: read status, examined/unresolved counts and limits. Duplicates are review candidates, not necessarily invalid routes. No HTTP/canonical/redirect/SEO completeness inference.

Limits:5records/step,200examined,2048UTF8bytes/URL,state512KiB. Limits/unresolved URLs yield partial results. No body storage/network/cron/CMSwrites. No CSV/download. One report/user,24h logical expiry, next read/Clear deletion; no background cleanup. Rerun after content changes.

Free; no paid edition/API key required. Contact:contact@lx3.cafe. 公開URLの完全一致重複だけを手動確認。上限/未解決は部分結果です。