A parks concession vendor's public sitemap.xml still lists staff-bio URLs that the current navigation no longer shows. What does that inventory give the researcher?
Select an answer to reveal the explanation.
Short Explanation
A sitemap is a leftover floor plan — rooms can still exist after the lobby directory is taken down. Those bio URLs are a public inventory, not a brute-force license. Fetch what the sitemap lists and keep the notes sourced.
Full Explanation
If a parks concession vendor’s public sitemap.xml still lists staff-bio URLs that current navigation no longer shows, that inventory gives the researcher a public list of URLs that can still be fetched even when the live nav hides them. Sitemaps are leftover floor plans useful in vendor and website OSINT. Treating the bios as never public and ignoring them fails; sitemap membership is evidence they were exposed as URLs. Using the sitemap as a license to brute-force admin URLs not listed fails as unauthorized enumeration beyond the public inventory. Emailing named staff using personal addresses harvested from the bios fails if those addresses were not meant for civic solicitation and may violate purpose limits. Exam caveat: fetch what the sitemap lists; do not expand into attack paths. Operational check: download sitemap.xml; attempt GETs on listed bio URLs; capture what still loads with dates; use content only as needed for the civic question and avoid harassing staff. In municipal practice, record the rationale in the case file so future staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate the finding against current public sources before the next procurement or communications decision.