Patrick Bass Area: Cross-cutting infra (audit p14) · Surface: /about (PageController@about, DEFAULT_ABOUT_BODY) · Dimension: ui-law · Severity: minor
Until a tenant writes its own About page, every public visitor to /about sees placeholder copy telling them to edit it via 'Admin → Site Pages → About Us'. That exposes admin navigation to end users who can't act on it (Law 6 spirit: users shouldn't see admin-only mechanics). It self-corrects once authored, but the default state ships an admin instruction to the public.
Evidence
platform/src/Controllers/PageController.php:38-41 — DEFAULT_ABOUT_BODY contains `A super admin can replace this text with your own story from <strong>Admin → Site Pages → About Us</strong>.` This is passed as $siteBody to site-pages/about.php (line 22 `$body = $page['body'] ?? self::DEFAULT_ABOUT_BODY;`) and rendered unconditionally inside `<div class="post-content"><?= $siteBody ?></div>` (templates/site-pages/about.php:31) for EVERY visitor — anonymous and regular users alike — until a super admin authors the page. The page's Edit button is correctly gated by isSuperAdmin (about.php:19), but the body copy that names the admin navigation is not.Suggested fix. Make the default About body customer-neutral (a welcome paragraph with no admin instructions), and surface the 'edit via Admin → Site Pages' hint only when isSuperAdmin is true (e.g. as an inline admin notice in about.php, not inside the public body).
Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.
Patrick Bass
@mobieus
