INC-001A — Revoke anonymous access to the membership-response artifact

[daliu]

Problem

A metadata-only Google Drive review, performed after a member reported spam soon after providing a phone number, confirmed one membership-response artifact with a permission of type anyone and role reader. Link discovery is disabled, but that does not restrict a person or crawler that obtains the link. Timing does not prove this artifact caused the spam.

No response row, member record, file content, download, or export was opened during the review. The exact file locator, permission identifier, owner, collaborators, and activity evidence are intentionally omitted from this public issue and belong only in the approved private incident record.

Atomic outcome

An authorized Google Drive owner removes the single anonymous reader permission, preserves minimal private before/after metadata and access evidence, and proves by permission-list readback that no anyone or unintended domain permission remains. Then the incident/privacy owner records a scoped follow-up decision without copying member data into GitHub.

Owner-only containment steps

1. Approve revocation of the identified anonymous reader permission.
2. Use the owning club Google account to change General access to Restricted or remove that exact permission.
3. Do not open, download, export, sort, search, or screenshot response rows.
4. Read back permission metadata only and prove there is no anyone or unintended domain permission.
5. Privately preserve the check time, target revision/permission metadata, approver, actor, and before/after result.
6. Privately review Drive activity, sharing history, Form destination, add-ons/scripts, account sessions, and named collaborators using minimum access.
7. Route scope, notification, retention, and outside-advice decisions through DATA-001B — Inventory personal data and approve a minimization/retention matrix #110 and OPS-SEC-001 — Establish private security/privacy reporting and rehearse incident response #112; do not infer them from spam timing.

Acceptance criteria

• A named owner explicitly authorizes the provider-side permission change.
• The anonymous reader permission is removed by an authorized Google Drive owner.
• A metadata-only readback proves no anyone or unintended domain permission remains.
• Minimal private before/after evidence and relevant activity/sharing evidence are preserved in the approved incident location.
• Named collaborator access is reviewed for least privilege without publishing identities.
• Form destination, add-ons/scripts, and account-session risks receive separate redacted outcomes or tickets.
• No response row, phone number, email, emergency contact, screenshot, export, private URL, or permission identifier is placed in GitHub, email, or an AI tool.
• The incident owner records whether further containment or communication is required; this issue makes no legal or breach conclusion.

Stop conditions

Stop and escalate if the actor is not the owner, the target cannot be identified from the private record, the requested change would remove named collaborators or alter/delete responses, metadata readback cannot prove the result, activity review would expose rows, or credentials/recovery codes are requested.

Dependencies and coordination

• Child containment gap from OPS-SEC-001 — Establish private security/privacy reporting and rehearse incident response #112; also informs DATA-001B — Inventory personal data and approve a minimization/retention matrix #110 and BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113.
• DATA-001C1 — Pause optional My Account phone collection during privacy review #178 separately paused optional phone collection in My Account source. It did not change Google Drive.
• The public Google Site and discount-code access remain MEMBERS-ACCESS-001 — Restrict the exposed Google Site and contain leaked discounts #80/MEMBERS-CONTENT-001 — Build the Firebase-native members-only discounts page #83, not this issue.
• Provider action is owner-only. Creation is not an agent claim; keep status:blocked-owner until explicit authorization is recorded.

Officer impact: the authorized Google Drive owner performs one narrowly scoped sharing change; other officers must not inspect or distribute response data.

Officer documentation: None — current incident and emergency procedures remain authoritative; update them only if the verified provider workflow changes.

Deployment evidence: source not affected; website/Firebase not affected; Google Drive configuration and metadata readback must be recorded separately; production-data contents must not be used as proof.

[daliu]

CLAIMED — 2026-07-13T22:27:06Z

• Owner: /root, acting under explicit user authorization received in Codex.
• Execution surface: provider-only; no source branch or worktree.
• Exact scope: remove only the confirmed anyone:reader permission from the privately identified 2026 membership-response artifact, then perform metadata-only permission readback.
• Immutable: named user permissions, spreadsheet contents, response rows, Form configuration, and every other Drive file.
• Stop conditions: wrong or ambiguous target, non-owner account, request for credentials/OTP, row/content exposure, or any sharing change beyond the single anonymous permission.
• Current state: pre-change metadata reconfirmed; browser sign-in is required before the authorized sharing action. No permission or data has changed yet.

Do not begin overlapping work until a timestamped release is posted.