linkdrift.py --dir InvoicePlane on InvoicePlane/InvoicePlane reported 54 hard findings. All 54 are on github.com, and 51 of them are one shape.
Where: .github/CHANGELOG.md, 51 distinct addresses.
What the tool said: [404] https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-2j6j-6f6q-57vq and 50 more like it.
What is actually there: the repository's own security advisories, cited in a vulnerability table next to CVSS scores and reporter credits.
Why the 404 proves nothing. A repo-scoped advisory URL is visible to collaborators. For an advisory in draft state — or simply one GitHub does not list publicly — an anonymous request gets 404, exactly as it would for an identifier that never existed. I could not tell the two apart from outside either: the repo lists 12 published advisories through the API, the CHANGELOG cites 51, and the two sets do not overlap at all. The likeliest reading is 51 drafts, which is entirely legitimate and none of a link checker's business.
That is the point: for this URL shape a 404 carries no information about the address, so no claim can be made from it. This is species D — a negative claim from an incomplete source — and it is the cheapest kind to make by accident, because the status code looks so definite.
Cost: 51 of 54.
Suggested shape: treat github.com/<owner>/<repo>/security/advisories/GHSA-* as unverifiable rather than dead, the same way 403 is already treated as "not let in". The global form github.com/advisories/GHSA-* is public and can still be checked normally.
The remaining three from the same run, for completeness:
https://github.com/OWNER/REPO/settings/secrets/actions (.github/workflows/crowdin-sync.yml:30) — a literal placeholder in a comment. _TEMPLATED knows YOUR[_-] and xxx but not the OWNER/REPO convention.https://github.com/de3erve-hunter (.github/CHANGELOG.md:39) — a security reporter credited by name; the account is gone. Genuinely a dead address, and genuinely nothing anyone can fix: you cannot rewrite someone's credit line.https://github.com/.../releases/download/v1.7.2/InvoicePlane-v1.7.2.zip (MIGRATION_GUIDE_v1.7.2.md:161) — a commented-out wget in a guide for a version that has not shipped yet; the newest release is v1.7.2-rc-1. Documentation written ahead of a release is not drift. (Worth noting separately that the filename would not match either: all eight existing releases name the asset <tag>.zip, never InvoicePlane-<tag>.zip. That is a real observation about the project, but not one a link checker can support.)
linkdrift.py --dir InvoicePlaneon InvoicePlane/InvoicePlane reported 54 hard findings. All 54 are ongithub.com, and 51 of them are one shape.Where:
.github/CHANGELOG.md, 51 distinct addresses.What the tool said:
[404] https://github.com/InvoicePlane/InvoicePlane/security/advisories/GHSA-2j6j-6f6q-57vqand 50 more like it.What is actually there: the repository's own security advisories, cited in a vulnerability table next to CVSS scores and reporter credits.
Why the 404 proves nothing. A repo-scoped advisory URL is visible to collaborators. For an advisory in draft state — or simply one GitHub does not list publicly — an anonymous request gets 404, exactly as it would for an identifier that never existed. I could not tell the two apart from outside either: the repo lists 12 published advisories through the API, the CHANGELOG cites 51, and the two sets do not overlap at all. The likeliest reading is 51 drafts, which is entirely legitimate and none of a link checker's business.
That is the point: for this URL shape a 404 carries no information about the address, so no claim can be made from it. This is species D — a negative claim from an incomplete source — and it is the cheapest kind to make by accident, because the status code looks so definite.
Cost: 51 of 54.
Suggested shape: treat
github.com/<owner>/<repo>/security/advisories/GHSA-*as unverifiable rather than dead, the same way 403 is already treated as "not let in". The global formgithub.com/advisories/GHSA-*is public and can still be checked normally.The remaining three from the same run, for completeness:
https://github.com/OWNER/REPO/settings/secrets/actions(.github/workflows/crowdin-sync.yml:30) — a literal placeholder in a comment._TEMPLATEDknowsYOUR[_-]andxxxbut not theOWNER/REPOconvention.https://github.com/de3erve-hunter(.github/CHANGELOG.md:39) — a security reporter credited by name; the account is gone. Genuinely a dead address, and genuinely nothing anyone can fix: you cannot rewrite someone's credit line.https://github.com/.../releases/download/v1.7.2/InvoicePlane-v1.7.2.zip(MIGRATION_GUIDE_v1.7.2.md:161) — a commented-outwgetin a guide for a version that has not shipped yet; the newest release isv1.7.2-rc-1. Documentation written ahead of a release is not drift. (Worth noting separately that the filename would not match either: all eight existing releases name the asset<tag>.zip, neverInvoicePlane-<tag>.zip. That is a real observation about the project, but not one a link checker can support.)