1 file changed, 3 insertions, 3 deletions
diff --git a/source/scan-tree.c b/source/scan-tree.c
index 035e4e1..b941ec5 100644
--- a/source/scan-tree.c
+++ b/source/scan-tree.c
@@ -52,8 +52,8 @@ static int is_git_dir(const char *path)
  * A repository's own files belong to whoever can push to it, so the keys
  * that run a command, put raw markup on the page, hand a file to the browser
  * as markup, read a file off the disk or place a link wait on
- * trust-scan-config. A readme naming a git object, the form with a colon,
- * only reads from the repository and passes.
+ * trust-scan-config. A readme naming a tracked file only reads from the
+ * repository and passes.
  */
 static int trusted_key(const char *name, const char *value)
 {
@@ -70,7 +70,7 @@ static int trusted_key(const char *name, const char *value)
 		!strcmp(name, "logo-link")           ||
 		!strcmp(name, "clone-url")           ||
 		!strcmp(name, "enable-html-serving") ||
-		(!strcmp(name, "readme") && !strchr(value, ':'));
+		(!strcmp(name, "readme") && !cgit_readme_is_tracked(value));
 	if (!untrusted)
 		return 1;
 	fprintf(stderr, "[cgit] Ignoring %s in %s: trust-scan-config is not set\n", name,