A release path for historical files

Observe

Preserve source bytes and inspect behavior in isolation without current credentials.

Classify

Record purpose, owner, endpoints, data access, dependencies, and current necessity.

Decide

Retain, update, replace, convert, or exclude each executable and downloadable item.

Verify

Test the approved public artifact, headers, MIME types, hosts, and integrity after deployment.

Keep recovered files outside the release path

Store the unreviewed archive package in a quarantine workspace that is not served by the production web server. Preserve the original bytes, source URL, capture timestamp, response headers, detected MIME type, and checksum. Work on a separate reviewed copy so a later investigator can distinguish the archive response from every safety edit or replacement. When a page first fails because an asset is missing or invalid, use the archived image, CSS, and JavaScript diagnostic to trace the exact source request before replacing anything.

Classify scripts by purpose and dependency

Inventory inline code, first-party bundles, third-party libraries, tag managers, analytics, advertising, chat, payment, social widgets, and API clients. For each script, record where it is loaded, what it reads or writes, which hosts it contacts, whether the feature is still required, and whether a supported current replacement exists. Minified code still needs an ownership and purpose decision. Carry the approved allowlist into the recovered static website deployment guide so production headers and network behavior match the reviewed package.

Verify file identity before allowing a download

An archive response can contain HTML even when its filename ends in .js, .jpg, .pdf, or .zip. Compare the response MIME type, file signature, extension, and expected role before the file enters the reviewed package. Decode images, parse code with the appropriate tool, and inspect documents or archives in a controlled environment. A successful status code is not a safety result.

Inspect network behavior with current credentials absent

Load representative pages in an isolated browser profile with no current account sessions. Capture requests, redirects, storage writes, service-worker registration, pop-ups, downloads, and console errors. Block the archive host and lost origin after the first evidence pass. Any request to an unknown analytics account, advertising network, form endpoint, API, content delivery network, or update service needs an explicit retain, replace, or remove decision.

Replace unsupported dependencies deliberately

Identify package names and versions only when the evidence supports them. Compare retained libraries with their current official maintenance and security information, then decide whether the feature can be removed, updated, or rebuilt. Updating a major library can change APIs and page behavior, so test the actual routes that use it instead of assuming a newer filename is a safe drop-in replacement.

Create a release allowlist and post-launch watch

The release record should list every executable script, worker, embedded frame, downloadable archive, and document allowed into production. Include its local path, purpose, source or replacement provenance, checksum, owner, approved external hosts, and review disposition. Files not on the list remain outside the public artifact. This makes the production package smaller and turns future changes into reviewable diffs.

Archived file security release decision

Treat historical code and downloads as untrusted evidence until each executable item has a current purpose, owner, network boundary, and recorded release disposition.

Risk evidence

  • Original file hashes, detected MIME types, source captures, referring pages, and isolated behavior observations.
  • A script and endpoint inventory covering analytics, ads, forms, APIs, workers, embeds, dynamic loaders, and third-party libraries.
  • A production allowlist with approved files, hosts, replacements, reviewers, dates, and resulting checksums.

Approved release list

A security review register and smaller release artifact containing only code and downloads approved for the current website.

Quarantine trigger

Stop when historical credentials are reused, an HTML error response is treated as code or media, unknown scripts remain executable, or captured forms are reactivated without a current backend specification.

Review the recovered package before hosting

Keep historical files outside the public release until their identity, behavior, and purpose have documented dispositions.

Compare reviewed delivery options