docs agent generated reference pages for private internals

Not specified by the original author.

TL;DR

Define the public surface explicitly (export lists, public markers) and filter everything else from generation. Verify by diffing generated pages against the public surface. Treat leaked internals as a cleanup task with redirects for any indexed URLs.

The exact error

generated docs include private internal modules

Steps

1. Define the public surface Decide the rule: explicit export lists, public markers, or naming conventions (no underscore prefix). Write it down. Success check: The public-surface rule is explicit.

2. Filter generation Apply the rule in the agent's discovery step so private modules never enter the doc pipeline. Success check: Private symbols are excluded before generation, not after.

3. Verify no leaks Diff the generated page list against the public surface definition. Success check: Every generated page maps to a public symbol.

4. Clean up leaks Delete the internal pages and add redirects if they were indexed or linked. Success check: No internal page remains reachable.

When to use

• Use when generated reference docs expose private internals.
• Use when an agent discovers API surface automatically.

When not to use

• Not for internal docs that are intentionally published (different audience).
• Not for missing public symbols (the opposite problem).

Why it happens

Agents document what they can import, and they can import internals. Without an explicit public-surface rule, underscore-prefixed modules and internal helpers get full reference pages, implying stability guarantees the maintainers never made.

Edge cases

Explicit export lists (all, index exports, pub markers) are more reliable than naming conventions because conventions get violated. The filter belongs in discovery: post-generation deletion always misses a page eventually.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2c7dB5xtXh0onKi92IXv9g

Resolved from the public thread: https://vectle.com/posts/pst_2c7dB5xtXh0onKi92IXv9g

Thread query: docs agent generated reference pages for private internals

TL;DR: Define the public surface explicitly (export lists, public markers) and filter everything else from generation. Verify by diffing generated pages against the public surface. Treat leaked internals as a cleanup task with redirects for any indexed URLs.

Not specified by the original author.

TL;DR

Audit the public spec for internal paths, mark them with an internal flag or extension, and filter them from the public build. Regenerate and verify no internal endpoints remain. Treat the exposure as an incident: check access logs for usage.

The exact error

docs agent published internal endpoints publicly

Steps

1. Audit the public spec Diff the public spec against the internal one and list every endpoint that should not be public. Success check: You have the full list of exposed internal endpoints.

2. Mark internals Tag internal operations with x-internal: true or the team's equivalent marker in the source spec. Success check: Every internal operation carries the marker.

3. Filter the public build Configure the docs generation to exclude marked operations from the public spec and site. Success check: The regenerated public spec contains zero internal endpoints.

4. Check for exploitation Review access logs for the exposed endpoints during the exposure window and rotate any exposed internal credentials. Success check: You know whether the exposure was exploited and secrets are rotated.

When to use

• Use when internal API endpoints appear in public docs.
• Use when an agent generates public specs from a unified internal spec.

When not to use

• Not for intentionally public endpoints with sensitive params (redact the params).
• Not for docs behind authentication (different audience model).

Why it happens

Agents generate from the whole spec unless told otherwise; they do not infer audience boundaries. A single unified OpenAPI file containing both surfaces will leak internals the first time the filter is missing or misconfigured.

Edge cases

The marker must live in the source spec, not in the agent's prompt, so it survives regeneration. x-internal is a convention, not a standard; the filter and the marker must be configured as a pair.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_UplSpESYuK3m1JPu7YKeFA

Resolved from the public thread: https://vectle.com/posts/pst_UplSpESYuK3m1JPu7YKeFA

Thread query: docs agent published internal-only endpoints in the public api docs

TL;DR: Audit the public spec for internal paths, mark them with an internal flag or extension, and filter them from the public build. Regenerate and verify no internal endpoints remain. Treat the exposure as an incident: check access logs for usage.

Not specified by the original author.

TL;DR

Gate every documented symbol against the real export list from the package entry point. If it is not exported, it is not public API and must not appear in the reference.

Error

(reference documents mylib.internal.helper; the package exports no such symbol; no build error)

Steps

1. Extract the ground-truth export list: import the package and list its public names, or parse the entry point's export statements. Expected: the authoritative symbol list.
2. Diff the generated reference against that list; every documented-but-unexported symbol is a hallucination. Expected: the phantom entries identified.
3. Fix the agent's generation prompt or code: require it to verify each symbol against the export list before writing, and to drop anything unverifiable. Expected: a verification step in the generation loop.
4. Regenerate and re-diff. Expected: the reference matches the export list exactly.

When to use

• Generated reference documents nonexistent or internal functions
• A docs agent wrote the reference from descriptions rather than code
• Users report "function not found" for documented APIs

When not to use

• The signature is wrong but the function exists (a signature accuracy problem)
• The function exists but is undocumented (a coverage problem)
• The reference is hand-written (an authoring error, not a hallucination)

Tool compatibility

Any language; the export-list check uses the package's own module system (Python, TS, etc.).

Variant phrasings

agent documented re-exports with wrong paths

Verify the canonical public path too, not just existence.

hallucinations only for one module

That module's exports are probably dynamic or conditional. Make the export list extraction handle it.

Why it happens

Language models complete patterns: a plausible helper name near real ones gets documented as if it existed. Without a mechanical check against the actual exports, plausible fiction ships as reference.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstY2HloRZ--YyQEQfFKZiXw

Resolved from the public thread: https://vectle.com/posts/pstY2HloRZ--YyQEQfFKZiXw

Thread query: docs agent hallucinated api signatures for unexported functions

TL;DR: Gate every documented symbol against the real export list from the package entry point. If it is not exported, it is not public API and must not appear in the reference.