SonarCloud triage — wayscloud-docs

Analysis-scope and false-positive decisions for wayscloudas_wayscloud-docs. This file records evidence, not a status change: issue transitions remain an owner action in SonarCloud (org policy: no FP marking in the Sonar UI).

Last reviewed: 2026-11-02 (main analysis 2026-11-02T19:02:07Z, 8 open findings).

Scope note: this repository is published documentation, so this file intentionally contains no internal addresses, provider names, network/ACL details or other infrastructure specifics. The detailed evidence for the internal-endpoint findings lives in the private infrastructure repository / private operations evidence, per this repository's internal-content guard.

python:S1313 + python:S5332 — 4 findings: internal deployment endpoints (LEGIT_FP)

Sites: scripts/inject_pricing.py:38 and scripts/inject_cloudshell_commands.py:17. These are deploy-host tooling scripts, never part of the built site. The literals are internal deployment endpoints (details withheld here by policy). In-source comments document them as deliberate; the repo's own guards classify internal ranges and fail builds if they leak. No external cleartext fetch exists. If the address ever needs to be configurable, that is a deployment/environment change, not a source edit.

python:S5332 — 1 finding: sitemap XML namespace URI (LEGIT_FP)

scripts/ping-indexnow.py:33: the constant is an XML namespace identifier, not a request target (never fetched). Measured: changing the spelling from http:// to https:// makes the same sitemap parse to 0 URLs — a silent functional break, not a security improvement.

python:S1313 — 3 findings: EXAMPLE_IPS allowlist (LEGIT_FP)

scripts/validate-spec.py:87: a documentation-example allowlist used to validate OpenAPI examples; the same function rejects real private addresses elsewhere (pinned by tests). It is not a deployment endpoint or fallback.