Add Rebrands & Reorganizations governance page (rebased from #442)#546
Conversation
Rebases PR security-alliance#442 by umar-ahmed onto current develop, resolving merge conflicts. Content is preserved as-is; only config files (fetched-tags.json, vocs.config.ts) were adapted for the vocs v2 migration. Contributor frontmatter updated to credit mattaereal and scode2277 as reviewers. Based on security-alliance#442.
Sidebar Configuration ReminderThis PR includes added, renamed, or removed documentation files:
Please ensure that:
See Contributing Guide – Sidebar & Navigation for more details. This is an automated reminder. If this PR doesn't need sidebar changes, you can ignore this message. |
built with Refined Cloudflare Pages Action⚡ Cloudflare Pages Deployment
|
|
@frameworks-volunteer, within this same PR, do not open a new one, update as follows:
|
- Fix frontmatter title to include "| Security Alliance" suffix - Expand description to 140+ chars with action verbs - Add Key Takeaway block after intro per AGENTS.md convention - Condense "Inherited Reputation" and "DNS" into single subsection - Transform "Keep Old Accounts" bullet list into scannable table - Add "Lesson:" line after each case study (MakerDAO, FTX, OpenClaw) - Replace bare URLs in Additional Resources with descriptive link text - Add Related Frameworks cross-references section
|
Model: All 8 requested changes have been committed and pushed (7d50484). Here is the breakdown: Items 1, 3, 4, 5, 6, 7 — committed to the branch
Item 2 — mermaid diagram (for your review, not in the page)Condensed "Inherited Reputation" and "DNS" into a single subsection as agreed. The mermaid diagram below was drafted to summarize why transitions attract attackers. It is not in the committed page — posting it here for your review: graph TD
A[Rebrand / Acquisition / Shutdown] --> B{Attack Surface}
B --> C[Inherited Reputation<br/>Expired domains retain trust signals<br/>MX/TXT records exploited]
B --> D[Confusion<br/>Mental models shattered<br/>Real vs fake hard to distinguish]
B --> E[Urgency<br/>Time pressure is organic<br/>Attackers just swap the link]
B --> F[Authority Disruption<br/>New team unknown<br/>Impersonation trivial]
B --> G[Pre-Qualified Targets<br/>Holders identified & motivated<br/>Phishing is surgical]
B --> H[Emotional Vulnerability<br/>Fear & frustration<br/>Users skip verification]
B --> I[Information Asymmetry<br/>Insider info gap<br/>Fake leaks land]
C --> J[Phishing & Impersonation]
D --> J
E --> J
F --> J
G --> J
H --> J
I --> J
If you think it adds value, I can add it to the page. Otherwise it stays out. Item 8 — primer: filling the smart contract migration security gapThe page currently has no mention of contract-level risks during token migrations (MKR→SKY, etc.). Here is how that gap could be filled: Proposed subsection: "Smart Contract Migration Security" Location: after the "Best Practices" list, before "Additional Resources" — or as a new subsection under "Practical guidance." Content outline:
This could be a dedicated subsection or folded into the existing "Best Practices" list as additional items (12-15). Let me know which approach you prefer and I will implement it. |
|
One last thing. Add the original contributor to contributors.json as the original creator/writer of this piece, keeping sara and me as reviewers. @frameworks-volunteer |
|
Model: Done. Added The MDX frontmatter in No further changes needed on this PR from my side. |
|
Thanks for getting this to the finish line for me. Much appreciated! |
4 participants
Summary
Rebases PR #442 (@umar-ahmed's "Rebrands & Reorganizations" governance page) onto current
develop, resolving all merge conflicts caused by the vocs v1→v2 migration and the OpSec/Physical Security de-overlap.Original content from
umar-ahmedis preserved verbatim. Only config files were adapted:utils/fetched-tags.json— entry for/governance/rebrands-and-reorgsadded cleanly on top of current developvocs.config.ts— sidebar entry placed under the Governance section withdev: truemattaerealandscode2277as reviewers per bot workflow rulesThe original PR #442 had conflicts in
utils/fetched-tags.jsonandvocs.config.tsbecause the file structures changed significantly during the vocs v2 migration. This PR carries forward the same content without modification.Suggested Content Gaps & Structural Observations
These are observations on the existing content — nothing is forced here. The author can address these in follow-up commits or leave them for community contribution.
1. Frontmatter title and description format
The title is
"Rebrands & Reorganizations"but per the repo convention, it should follow the pattern"Page | Security Alliance"(e.g.,"Rebrands & Reorganizations | Security Alliance"). The description is also slightly short (~110 chars vs the 140-160 char target). Suggested:"Rebrands & Reorganizations | Security Alliance""Practical guidance and case studies on handling rebrands, acquisitions, and wind-downs to protect communities from scams, phishing, and impersonation during transitions."2. Section ordering follows a different pattern than sibling pages
Most governance pages (e.g., Risk Management, Council Best Practices) lead with a short intro, then practical guidance/best practices, then "Why important", then pitfalls. This page puts "Practical guidance" first (good), then "Why is it Important" with 8 sub-sections, then "Common pitfalls & examples", then a separate "Best Practices" list.
The "Why is it Important" section is thorough but quite long (8 subsections). Consider:
3. Missing Key Takeaway block
Per the AGENTS.md convention, playbook/template pages should have a top-level
> 🔑 **Key Takeaway**:summary (<40 words). Adding one after the intro would match sibling pages.4. Practical guidance could use a checklist or table
The "Keep Old Accounts" section lists domains, social handles, Discord vanity URLs, and X.com handles as bullet points. A table (Asset → Risk if abandoned → Action) would make it scannable and match the practical-tone of other pages.
5. Case studies section lacks a "What went wrong / what to do instead" pattern
Each case study (MakerDAO→Sky, FTX, OpenClaw/ClawdBot) describes the incident and the mistake, but doesn't explicitly state the corrective action in a consistent format. Consider adding a one-line "Lesson:" after each case study, e.g.:
6. Additional resources section uses bare URLs
The repo convention is to use descriptive link text. Suggested:
7. Missing cross-references to related frameworks
The page could link to related content within the site:
/governance/risk-management— for risk assessment during transitions/incident-management/incident-detection-and-response— for post-transition monitoring/opsec/endpoint/overview— for key rotation and credential hygiene8. No mention of smart contract migration security
Rebrands involving token migrations (MKR→SKY, etc.) have contract-level risks. A brief subsection or cross-reference on verifying new contract addresses, revoking old approvals, and communicating contract changes would fill a gap.
Based on #442. Credit to @umar-ahmed for the original content.