fix(docs): wrong-target and redirected links from the review

crowdsec-docs/docs/appsec/bot_detection/configuration.md

@@ -135,4 +135,4 @@ level=info msg="on_challenge_submit rejected" source=203.0.113.7 reason=fast-bot
 If you don't see any `challenge submission` lines at all after a reload, double-check that:
 
 - The new appsec-config is listed in your AppSec datasource (`appsec_configs:`) — see [Where to set these values](#where-to-set-these-values).
-- The bouncer is forwarding `/crowdsec-internal/challenge/*` paths unchanged — see [Prerequisites](intro.md#prerequisites) on the intro page.
+- The bouncer is forwarding `/crowdsec-internal/challenge/*` paths unchanged — see [Internal challenge endpoints](challenge_protocol.md#internal-challenge-endpoints).

crowdsec-docs/docs/appsec/bot_detection/intro.md

@@ -48,7 +48,7 @@ For the full request flow, see [How it works](how_it_works.md).
 ## Next steps
 
 - [Enable bot detection](enable.md) — install the collection, wire the acquisition, and verify it.
-- [See default collection](whats_included.md) — the request flow, the appsec-config, known-bot handling, and behavioral scenarios you just enabled.
+- [Default configuration](whats_included.md) — the scoring and threshold appsec-configs, known-bot and path exclusions, alerts, and behavioral scenarios you just enabled.
 - [Customization & recipes](customization.md) — narrow the challenge to a path, allowlist a probe, and react to the bot signal in your own scenarios.
 - [Configuration](configuration.md) — master secret, key rotation, cookie TTL, and JS obfuscation.
 - [Hooks reference](hooks.md) — full list of helpers and the `on_challenge` / `on_challenge_submit` stages.

crowdsec-docs/docs/appsec/configuration_creation_testing.md

@@ -21,7 +21,7 @@ Often you will want multiple AppSec configurations to define groups of rules tha
 Use the `appsec_configs` parameter to load multiple configurations that work together.
 
 In the following example we have two configurations:
-- One with [CrowdSec default AppSec rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-configurations/appsec-default) running in in-band mode
+- One with [CrowdSec default AppSec rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/waf-configurations/appsec-default) running in in-band mode
 - The other for the [CRS rules ↗️](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-crs) that run in out-of-band mode by default
 
 ```yaml title="/etc/crowdsec/acquis.d/appsec.yaml"
@@ -94,7 +94,7 @@ When multiple AppSec configurations are loaded, they are processed in the order
 After updating AppSec configuration files:
 
 1. Reload CrowdSec so it picks up the new configuration.
-2. Validate behavior with your usual test traffic, or use the [generic AppSec test rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/appsec-generic-test).
+2. Validate behavior with your usual test traffic, or use the [generic AppSec test rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/appsec-generic-test).
 3. Inspect results in logs or via `cscli metrics show appsec`.
 
 For more troubleshooting guidance, see [AppSec Troubleshooting](troubleshooting.md).

crowdsec-docs/docs/appsec/quickstart/general.mdx

@@ -147,7 +147,6 @@ Now that the AppSec Component is configured and running, you need to:
 
 For specific remediation component configuration, see:
 - [Nginx/OpenResty Setup](nginxopenresty.mdx)
-- [OpenResty Setup](nginxopenresty.mdx)
 - [Traefik Setup](traefik.mdx)
 - [HAProxy (SPOA) Setup](haproxy_spoa.mdx)
 - [WordPress Setup](wordpress.mdx)

crowdsec-docs/docs/appsec/quickstart/haproxy_spoa.mdx

@@ -95,7 +95,7 @@ sudo cscli metrics show appsec
 1. `curl` hit HAProxy at `/.env`.
 2. HAProxy forwarded the request to the SPOA remediation component.
 3. The bouncer queried the AppSec Component at `appsec_url`.
-4. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule.
+4. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule.
 5. AppSec answered `403`; HAProxy blocked the request.
 
 </details>

crowdsec-docs/docs/appsec/quickstart/nginx-ingress.mdx

@@ -16,8 +16,8 @@ has known security issues, and upstream removed Lua support in version `1.12`,
 which this integration depends on.
 
 Do not use this for new deployments. If you are already using it, plan a migration
-to another supported integration such as [Traefik](/docs/next/appsec/quickstart/traefik)
-or [Envoy Gateway](/docs/next/appsec/quickstart/envoy-gateway).
+to another supported integration such as [Traefik](/appsec/quickstart/traefik.mdx)
+or [Envoy Gateway](/appsec/quickstart/envoy-gateway.mdx).
 :::
 
 ## Objectives

crowdsec-docs/docs/appsec/quickstart/nginxopenresty.mdx

@@ -91,7 +91,7 @@ curl -I http://localhost/.env
 
 You should get an `HTTP/1.1 403 Forbidden` response.
 
-We're hitting a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) — the AppSec Component detects and blocks it.
+We're hitting a `.env` file, a [common way to retrieve credentials left by mistake](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) — the AppSec Component detects and blocks it.
 
 Check that CrowdSec recorded the block:
 
@@ -125,7 +125,7 @@ Appsec '127.0.0.1:7422/' Rules Metrics:
 
 1. `curl` hit your web server at `/.env`.
 2. The bouncer forwarded the request to the AppSec Component on `127.0.0.1:7422`.
-3. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule.
+3. The request matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule.
 4. The AppSec Component answered `403`, the bouncer enforced it, and the web server returned the CrowdSec ban page.
 
 </details>

crowdsec-docs/docs/appsec/quickstart/npmplus.mdx

@@ -163,7 +163,7 @@ Appsec '0.0.0.0:7422/' Rules Metrics:
 
 1. `curl` hit NPMplus at `/.env`.
 2. The NPMplus bouncer forwarded the request to the AppSec Component inside the Docker network (on `crowdsec:7422`).
-3. AppSec matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access) rule and answered `403`.
+3. AppSec matched the [`vpatch-env-access`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access) rule and answered `403`.
 4. NPMplus served the ban page.
 
 </details>

crowdsec-docs/docs/appsec/quickstart/traefik.mdx

@@ -667,7 +667,7 @@ What happened in the test that we just did is:
  1. We did a request (`localhost/.env`) to our local webserver
  2. Thanks to its configuration, the Remediation Component forwarded the request to the AppSec Component
  3. Our AppSec Component, listening on `http://127.0.0.1:7422` analyzed the request
- 4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-env-access)
+ 4. The request matches the [AppSec rule to detect .env access](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-env-access)
  5. The AppSec Component thus answered with [HTTP 403](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403) to the Remediation Component, indicating that the request must be blocked
  6. The web server then presented us with the default "request blocked" page.
 

crowdsec-docs/docs/appsec/quickstart/wordpress.mdx

@@ -70,7 +70,7 @@ AppSec requires the WordPress plugin to use API-key authentication (not TLS cert
 
 ## 4. Verify
 
-From any machine, send a request with a malicious body through WordPress — this example trips the [`vpatch-CVE-2022-22965`](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-CVE-2022-22965) rule (Spring4Shell):
+From any machine, send a request with a malicious body through WordPress — this example trips the [`vpatch-CVE-2022-22965`](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2022-22965) rule (Spring4Shell):
 
 ```bash
 curl -X POST https://<your-wordpress-url>/ \

crowdsec-docs/docs/appsec/rules_syntax.md

@@ -135,7 +135,7 @@ rules:
           value: /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl
 ```
 
-See the [appsec-generic-test rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/appsec-generic-test) for a full example.
+See the [appsec-generic-test rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/appsec-generic-test) for a full example.
 
 ### Rule condition fields
 

crowdsec-docs/docs/appsec/troubleshooting.md

@@ -178,7 +178,7 @@ To test that the AppSec Component is working, send requests directly to it. Keep
 
 
 This example tests detection for CVE-2023-42793, part of the [virtual patching collection](https://app.crowdsec.net/hub/author/crowdsecurity/collections/appsec-virtual-patching). Make sure the collection is installed (`cscli appsec-rules list`).
-[This rule](https://app.crowdsec.net/hub/author/crowdsecurity/appsec-rules/vpatch-CVE-2023-42793) detects requests to a URI ending with `/rpc2`:
+[This rule](https://app.crowdsec.net/hub/author/crowdsecurity/waf-rules/vpatch-CVE-2023-42793) detects requests to a URI ending with `/rpc2`:
 
 > cat /etc/crowdsec/appsec-rules/vpatch-CVE-2023-42793.yaml
 ```yaml

crowdsec-docs/docs/contributing/code.md

@@ -39,7 +39,7 @@ Run with `make bats-build bats-fixture` once, then `make bats-test-hub`.
 
 We receive contributions on the _master_ branch (or _main_, in recent repositories). To contribute, fork the repository, commit the code in a dedicated branch and ask for a Pull Request. By default it will target the master branch on the upstream repository, so in most cases you don't have to change anything. It will be reviewed by the core team and merged when ready, possibly after some changes. It is recommended to open [an Issue linked to the PR](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) in order to discuss it and track its progression.
 
-You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/hub/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above, and "Style guide" below).
+You may also receive feedback from the CI scripts (directory [.github/workflows](https://github.com/crowdsecurity/crowdsec/tree/master/.github/workflows)) that run a series of linters and tests. You are encouraged to run these on your environment as well, before committing (see the "Testing" section above).
 
 ## Release branches
 

crowdsec-docs/docs/contributing/specs/bouncer_appsec_specs.mdx

@@ -318,7 +318,7 @@ You can refer to the AppSec documentation to test request forwarding.
 
 * **startup:** set it to **TRUE** for the **initial call** to get all decisions *(when False you’ll get the delta from your last call)*  
 * **scopes:** “ip,range” is the only relevant value when remediating on IPs  
-* **origins:** Leave blank to allow all origins, test your configurable origins with [those tests](#decision-example)  
+* **origins:** Leave blank to allow all origins, check your configurable origins against the [decision example](#decision-example)  
 * **scenarios_containing:** leave blank by default, allow change in config  
 * **scenarios_not_containing:** leave blank by default, allow change in config
 
@@ -330,7 +330,7 @@ You can refer to the AppSec documentation to test request forwarding.
 * **ip:** ignore/leave blank: shortcut for scope:ip \+ value  
 * **range:** ignore/leave blank: shortcut for scope:range \+ value  
 * **contains:** leave blank by default, configurable by user  
-* **origins:** Leave blank to allow all origins, test your configurable origins with [those tests](#decision-example)  
+* **origins:** Leave blank to allow all origins, check your configurable origins against the [decision example](#decision-example)  
 * **scenarios_containing:** leave blank by default, allow change in config  
 * **scenarios_not_containing:** leave blank by default, allow change in config
 

crowdsec-docs/docs/expr/strings_helpers.md

@@ -100,8 +100,6 @@ If sep is empty, Split splits after each UTF-8 sequence. If both s and sep are e
 
 It is equivalent to SplitN with a count of -1.
 
-To split around the first instance of a separator, see Cut.
-
 ### `SplitAfter(s string, sep string) []string`
 
 SplitAfter slices s into all substrings after each instance of sep and returns a slice of those substrings.
@@ -141,8 +139,6 @@ n < 0: all substrings
 
 Edge cases for s and sep (for example, empty strings) are handled as described in the documentation for Split.
 
-To split around the first instance of a separator, see Cut.
-
 ### `Replace(s string, old string, new string, n int) string` 
 
 Replace returns a copy of the string s with the first n non-overlapping instances of old replaced by new. If old is empty, it matches at the beginning of the string and after each UTF-8 sequence, yielding up to k+1 replacements for a k-rune string. If n < 0, there is no limit on the number of replacements.

crowdsec-docs/docs/getting_started/crowdsec_tour.mdx

@@ -83,7 +83,7 @@ sudo cscli decisions list
 
 If you just deployed CrowdSec, the list might be empty, but don't worry, it simply means you haven't yet been attacked, congrats! Adding `-a` flag will as well list the decisions you received from the [community blocklist](/central_api/intro.md).
 
-Check [decisions](/u/user_guides/hub_mgmt) management for more !
+Check [decisions management](/u/user_guides/decisions_mgmt) for more!
 
 <details>
   <summary>Listing decisions example</summary>

crowdsec-docs/docs/intro.mdx

@@ -10,7 +10,7 @@ import AcademyPromo from "@site/src/components/academy-promo"
 
 The [CrowdSec Security Engine](https://github.com/crowdsecurity/crowdsec) is an open-source, lightweight security engine that detects and blocks malicious actors. It analyzes logs and HTTP requests using behavior-based patterns called scenarios.
 
-CrowdSec is modular: it provides [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/appsec-rules), and optional [Remediation Components](https://app.crowdsec.net/hub/remediation-components) that enforce blocks.
+CrowdSec is modular: it provides [behavior-based detection](https://app.crowdsec.net/hub/collections), including [AppSec rules](https://app.crowdsec.net/hub/waf-rules), and optional [Remediation Components](https://app.crowdsec.net/hub/remediation-components) that enforce blocks.
 
 <div style={{ display: "flex" }}>
     <div style={{ textAlign: "center", flex: "1" }}>
@@ -65,7 +65,7 @@ This architecture supports simple standalone setups and more distributed deploym
 -   Centralized logs (rsyslog, Loki, ...): [Run CrowdSec next to your log pipeline](/u/user_guides/log_centralization), not on production workloads.
 -   Kubernetes: See [our Helm chart](/u/getting_started/installation/kubernetes).
 -   Containers: Use the [Docker data source](/log_processor/data_sources/docker.md).
--   WAF only: Start with the [AppSec quickstart](appsec/intro.md).
+-   WAF only: Start with the [AppSec introduction](appsec/intro.md).
 
 Distributed architecture example:
 

crowdsec-docs/docs/log_processor/collections/introduction.md

@@ -27,7 +27,7 @@ Collections are the recommended way to install detection content because they:
 Collections are distributed via the CrowdSec Hub and managed with `cscli`:
 
 - Update the Hub index: see [`cscli hub update`](/cscli/cscli_hub_update.md)
-- Install or upgrade items: see [`cscli hub upgrade`](/cscli/cscli_hub_upgrade.md) and [Hub management](/cscli/cscli_hub.md)
+- Install items: see [`cscli collections install`](/cscli/cscli_collections_install.md). Upgrade installed items: see [`cscli hub upgrade`](/cscli/cscli_hub_upgrade.md).
 
 ## Collection file format
 

crowdsec-docs/docs/log_processor/data_sources/appsec.md

@@ -56,19 +56,19 @@ Number of routines to use to process the requests. Defaults to 1.
 
 ### `auth_cache_duration`
 
-How long to cache the auth token for. Accepts values supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration).
+How long to cache the auth token for. Accepts values supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration).
 Defaults to 1m.
 
 ### `auth_timeout`
 
-How long to wait for the local API to validate the API key of a remediation component. Accepts value supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration).
+How long to wait for the local API to validate the API key of a remediation component. Accepts value supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration).
 Set to `0` to disable the timeout.
 Increase it if your local API is not on the same machine or is a few network hops away.
 Defaults to 200ms.
 
 ### `body_read_timeout`
 
-How long to wait for the remediation component to finish sending the request body before giving up and processing whatever was received. Accepts value supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration).
+How long to wait for the remediation component to finish sending the request body before giving up and processing whatever was received. Accepts value supported by [time.ParseDuration](https://pkg.go.dev/time#ParseDuration).
 Set to `0` to disable the timeout.
 Defaults to 1s.
 

crowdsec-docs/docs/log_processor/data_sources/cloudwatch.md

@@ -38,7 +38,7 @@ labels:
   type: apigateway
 ```
 
-Look at the `configuration parameters` to view all supported options.
+See [Parameters](#parameters) for all supported options.
 
 ## Parameters
 

crowdsec-docs/docs/log_processor/data_sources/docker.md

@@ -59,7 +59,7 @@ labels:
   type: log_type
 ```
 
-Look at the `configuration parameters` to view all supported options.
+See [Parameters](#parameters) for all supported options.
 
 
 ## Parameters

crowdsec-docs/docs/log_processor/data_sources/kafka.md

@@ -63,7 +63,7 @@ batch:
 The reader will always start from the latest offset.
 :::
 
-Look at the `configuration parameters` to view all supported options.
+See [Parameters](#parameters) for all supported options.
 
 ## Parameters
 

crowdsec-docs/docs/log_processor/data_sources/kinesis.md

@@ -30,7 +30,7 @@ labels:
 If your stream is written to by a [Cloudwatch subscription filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html), you will need to pass the `from_subscription` parameter, or the Security Engine won't be able to parse the content of the message.
 :::
 
-Look at the `configuration parameters` to view all supported options.
+See [Parameters](#parameters) for all supported options.
 
 ## Parameters
 

crowdsec-docs/docs/log_processor/data_sources/kubernetes.md

@@ -29,7 +29,7 @@ labels:
   type: nginx
 ```
 
-Look at the `configuration parameters` to view all supported options.
+See [Parameters](#parameters) for all supported options.
 
 ## Parameters
 

crowdsec-docs/docs/log_processor/data_sources/kubernetes_audit.md

@@ -16,7 +16,7 @@ labels:
  type: k8s-audit
 ```
 
-Look at the `configuration parameters` to view all supported options.
+See [Parameters](#parameters) for all supported options.
 
 ## Parameters
 

crowdsec-docs/docs/log_processor/data_sources/loki.md

@@ -26,7 +26,7 @@ labels:
 The reader will always start at "now".
 :::
 
-Look at the `configuration parameters` to view all supported options.
+See [Parameters](#parameters) for all supported options.
 
 ## Parameters
 

crowdsec-docs/docs/log_processor/data_sources/s3.md

@@ -44,7 +44,7 @@ When using the `sqs` polling method, make sure the Security Engine is the only r
 If other processes read from the queue, then the Security Engine will miss some events.
 :::
 
-Look at the `configuration parameters` to view all supported options.
+See [Parameters](#parameters) for all supported options.
 
 ## Parameters
 

crowdsec-docs/docs/log_processor/data_sources/victorialogs.md

@@ -27,7 +27,7 @@ labels:
 The reader will always start at "now" for `tail` mode.
 :::
 
-Look at the `configuration parameters` to view all supported options.
+See [Parameters](#parameters) for all supported options.
 
 ## Parameters
 

crowdsec-docs/docs/log_processor/scenarios/create.md

@@ -129,7 +129,7 @@ We have the following fields:
 -   a [type](/log_processor/scenarios/format.md#type): the type of bucket to use (trigger or leaky).
 -   a [name](/log_processor/scenarios/format.md#name)
 -   a [description](/log_processor/scenarios/format.md#description)
--   a [filter](/log_processor/scenarios/format.md#type): the filter to apply on events to be filled in this bucket.
+-   a [filter](/log_processor/scenarios/format.md#filter): the filter to apply on events to be filled in this bucket.
 -   a [leakspeed](/log_processor/scenarios/format.md#leakspeed)
 -   a [capacity](/log_processor/scenarios/format.md#capacity): the number of events in the bucket before it overflows.
 -   a [groupby](/log_processor/scenarios/format.md#groupby): a field from the event to partition the bucket. It is often the `source_ip` of the event.