Point the shut reporting route at the file that holds its state

[iderex]

Closes #206.

SECURITY.md named the private reporting form as where a report goes, said in
the same breath that the form does not answer, and then sent the reader to issue
#57 for the moment it opens. #57 closed as completed on the second half of its
own done-when - the parity row for each setting left off - rather than on the
setting, so the form is still shut and the pointer resolves to a finished piece
of work. A reporter who follows it reads the door as opened, which is the
opposite of the two sentences around the pointer, and this is the one document in
the tree read by somebody deciding in that moment whether to report privately or
in public.

What was wrong, at origin/main

git show origin/main:SECURITY.md | sed -n '17,19p'
Run 2026-08-10. So this file names the destination and states plainly that the
destination is currently shut, rather than sending a reporter to a door that
does not open. Opening it is issue #57, and it is not a change to this tree. The

gh issue view 57 --repo Flowfin/site --json state,stateReason --jq '"\(.state) \(.stateReason)"'
CLOSED COMPLETED

gh api repos/Flowfin/site/private-vulnerability-reporting
{"enabled":false}

All three run 2026-08-27, the first against 63b4c2b.

What the change does

The paragraph names the setting rather than an issue, and points at
docs/parity.md, which carries that setting with its reason and is a tracked
file rather than a tracker row that can close underneath the sentence:

git show f5c9790:SECURITY.md | sed -n '17,25p'
Run 2026-08-27. So this file names the destination and states plainly that the
destination is currently shut, rather than sending a reporter to a door that
does not open. Opening it is a repository setting rather than a change to this
tree, and [docs/parity.md](docs/parity.md) is where that setting is held, beside
the others this repository is measured against and does not have. The address
above is the one the form uses once the setting is on, so nothing here moves
when it changes. Until then the honest alternative is a public issue with as
little detail as the report can carry, which is a poor arrangement and is
written down as one.

No closed issue is named for the route any more:

git show f5c9790:SECURITY.md | grep -c '#57' ; echo "exit=$?"
0
exit=1

The destination the paragraph now points at is in the tree at this commit:

git ls-tree --name-only f5c9790 docs/parity.md
docs/parity.md

The reading pasted above the paragraph was taken again at this commit rather than
carried over, which is why the date moved with it. The command and its output are
unchanged, because the setting is unchanged.

The negative disclosure is not weakened

What the file admits, it still admits and in the same words: the form does not
answer today, the paragraph says so before it says anything else, and the public
issue with as little detail as the report can carry is still written down as the
poor arrangement it is. Nothing here turns any of that into an assurance. The
only sentence that moved is the one saying where the state is held.

What this does not do

It does not turn the setting on. That is a repository setting rather than a
change to this tree, it is unmeasured by anything here, and #206 is written not
to ask for it. The row in docs/parity.md goes on holding the gap.

It does not touch #62, whose last clause waits on the same setting. That issue's
done-when reaches four things and none of them is this file, which is how the
defect came to be sitting in a comment with no tracker row behind it.

The means

Prose in the tracked Markdown file that already carries the rule, edited in
place. The artefact is a document a person reads, the change is one paragraph of
it, and no other means would carry the same sentence to the same reader; adding a
language, a format or a generator step for one paragraph would cost the tree
something and buy nothing.

The gate, at this commit

go run . ci
gate: 7 legs, in order: format, vet, test, build, links, sitemap, invariants
  needs-network was not asked for. Asking costs a request to the public name from whatever machine runs it, and a verdict that moves when somebody else's service does rather than when this tree changes. Ask with: go run ./harness/needs-network
  format: ok, 74 file(s)
  vet: ok
  test: ok, 37 test file(s)
  build: ok, 22 file(s)
  links: every reference that stays inside this site resolves to a file the build wrote
  sitemap: every page the build wrote is listed once, and every entry has a page behind it
  invariants: ok, 39 rule(s) decided, 1 owed and not decided
7 of 7 legs ran. None was skipped.

go run . hygiene origin/main HEAD
hygiene: 1 non-merge commit(s) in origin/main..HEAD, origin internal
  f5c9790ef1f1: subject carries its reference
1 commit(s) judged, none refused.

git diff --name-only origin/main...HEAD
SECURITY.md

What no leg decides here

The links leg reads references inside the site the build produced. This file is
repository documentation and no page of the built site carries it, so the
reference added here is decided by no leg of the gate. I resolved it by hand with
the git ls-tree above, and a later edit that breaks it would be refused by
nothing.

needs-network was not asked for. Nothing in this change reads the network, and
the two tracker readings above were taken with gh at a terminal rather than by
anything in the tree.

No second reader

This change has not been read by a second person, and merging it is not evidence
that it has: the ruleset on the branch requires no approving review, so the pull
request is merged by the account that opened it. The evidence above stands in
place of that reading, and the whole of the change is seven lines of one
paragraph in one file.