Conversation
Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.
|
Claude finished @manager's task in 1m 37s —— View job Reviewing PR #177
SummaryThis PR is small and clean: it adds the self-hosted Umami Correctness / conventions
Flagged (inline comment on No other issues found. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */} | ||
| <script | ||
| defer | ||
| src="https://analytics.administration.ae/script.js" |
There was a problem hiding this comment.
Security: unverified third-party script domain. The tracker is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io (no shared brand/naming, .ae ccTLD). For a "self-hosted Umami" instance I'd expect something like analytics.keepsimple.io or another domain the org visibly controls.
This script runs on every page load with full DOM/cookie/localStorage access (same origin as the rest of the page once executed), so if this domain isn't actually owned/controlled by the KeepSimple team, this is a supply-chain risk (script content, and therefore what it does, is entirely outside this repo's control and can change at any time server-side).
Since this is already merged and live in production, can someone confirm:
- Who owns/operates
analytics.administration.ae? - Is this a KeepSimple-controlled self-hosted Umami box, or a third-party analytics vendor operating under that domain?
If it's not directly controlled by the org, consider proxying /script.js and the collect endpoint through a keepsimple.io subdomain/rewrite so the trust boundary is explicit and the vendor can be swapped without a client-side domain change.
1 participant
Ships the self-hosted, cookieless Umami tracker to production. Verified on staging: the tag is served, the site id matches our Umami instance, the tracker script and the collect endpoint are publicly reachable.
Only one commit ahead of main, two files: the script tag in
_document.tsxand the font passport block inCLAUDE.md. Mixpanel is untouched and keeps running alongside.🤖 Generated with Claude Code