Brand images and webapp copy: render counts from data, drop the personal credit

[emmanuelgjr]

Follow-up to the two findings reported in #213. C2 approved by the maintainer (2026-10-05). The social card turned out to have the same defect as the banner, so it's fixed too.

What was wrong

File	Problem
docs/og-image.svg: the social-preview image for every page (og:image / twitter:image)	25 frameworks, 1,514 controls, 41 entries, 67 mapping files, 114 incidents; old URL …/GenAI-Data-Security-Initiative; "Created by …" credit; "ML Classifier Pipeline"; "and 18 more"
docs/banner.svg (not referenced anywhere)	the same frozen counts plus 3,210 mappings; the same old URL and credit; "BGE + cross-encoder classifier"; only three source lists
docs/index.html	the Explorer card on the home page said "Search 41 OWASP entries … all 25 framework mappings"; the Submit page said "all 41 OWASP GenAI entries"

What this changes

• Counts are rendered, not typed. Both SVGs now carry the README's <!-- stats:… --> markers (SVG comments). scripts/render-stats.mjs renders README.md, docs/og-image.svg and docs/banner.svg, so the existing CI step npm run stats:check fails if any of them goes stale. Current values: 26 frameworks · 3,771 mappings · 51 entries · 77 mapping files · 147 incidents · 4 source lists · 27 registries.
• CONTROLS is dropped from both images. The webapp hero (1,107, mapped registries) and stats.json (1,184, all registries) count controls differently. Picking one would put a third definition in the images. MAPPINGS (the hero's headline) and SOURCE LISTS take its place.
• Attribution (C1):
  • The credit line is replaced by "OWASP GenAI Data Security Initiative".
  • Both files leave ATTRIBUTION_EXEMPT in validate.js. They were exempt only because brand assets were frozen, and the guard now covers them.
• Accuracy:
  • URL → genai-security-project.github.io/crosswalk.
  • The pipeline labels now name what actually produces the data ("Mapping files + registries", scripts/generate.js) instead of an ML classifier.
  • The banner lists all four source lists (adds AST01-10).
• Webapp copy: the two sentences now use DATA.length and FRAMEWORKS.length. A new webapp test asserts they match the loaded data.

Layout, colours and every other element of both images are unchanged.

Verification

• validate 0 errors / 92 warnings (same as main); stats:check current for all three targets; 95/95 tests (+1); no regen drift.

• Negative tests:

  • Setting the card's incident count back to 114 → ✗ docs/og-image.svg is stale, exit 1.
  • Putting the creator's name back in the banner → ✗ [docs/banner.svg] Personal attribution … C1, 1 error.

  Both were reverted.

• Both SVGs were rendered in Chrome and checked: no overflow, and the fourth source-list line fits its box.

Not changed (noted for later)

1. og:image is an SVG. Most social platforms (LinkedIn, X, Facebook, Slack) don't render SVG preview images, so link previews may show no image at all. Shipping a PNG would need a render step, so it's a separate decision.
2. validate.yml's path filters don't include scripts/render-stats.mjs or scripts/stats.js, so a PR touching only those wouldn't run Content Validation. This PR triggers it through docs/**.
3. The Submit page still says "Our classifier will propose mappings". Whether that flow should claim automated mapping is a product/C4 question, not a copy fix.

🤖 Generated with Claude Code