---
id: EXPO-5
family: GR-EXPO
level: core
profiles: [storage-api]
posture: normative-target
added: "1.0"
changed: "1.0"
source: https://flowdrop.io/spec/rules/gr-expo/expo-5
specification: FlowDrop Workflow Specification 1.0-draft
licence: CC BY 4.0
---

# EXPO-5 — Only an exact false suppresses default exposure

*GR-EXPO (Part I) · level: core · profiles: storage-api · added in 1.0*

The schema extension that suggests hiding a port is read by identity, not by truthiness. Anything that is not the boolean false leaves the port exposed, so a malformed or half-migrated value fails towards visible.

## The rule

> **Normative.** This is the rule.
>
> 1. A processor's `x-exposed-by-default` schema extension suppresses a port's default exposure only when its value is exactly the boolean `false`.
>
> 2. Any other value (including null, zero, an empty string, or the string `"false"`) leaves the port exposed by default, as does the key's absence (CFG-2).


## What it means

The comparison is identity, not truthiness. A processor asking for a port to
ship hidden has exactly one way to say so — the boolean `false`, and nothing
else. Every near-miss a loosely-typed schema or a round trip through another
format might produce — `null`, `0`, an empty string, even the string
`"false"` — leaves the port exposed. A malformed or half-migrated flag fails
towards visible, never towards hidden.

## Example

```json title="The one hiding value" verdict="hidden"
{ "x-exposed-by-default": false }
```

```json title="The string false, quoted, where the boolean was meant" verdict="exposed"
{ "x-exposed-by-default": "false" }
```

```json title="The key absent altogether" verdict="exposed"
{}
```

## Related rules

- Names: CFG-2, EXPO-6, EXPO-7
- Referenced by: CFG-2, EXPO-6, EXPO-7

---

Rule identifiers are permanent and are never renumbered. This specification carries
no implementation status: each implementation publishes its own standing against
these rules. Licensed CC BY 4.0.