Skip to content

fix: remove production analytics scripts#18

Merged
smiggleworth merged 2 commits into
mainfrom
fix/security-remove-production-analytics
Jul 26, 2026
Merged

fix: remove production analytics scripts#18
smiggleworth merged 2 commits into
mainfrom
fix/security-remove-production-analytics

Conversation

@smiggleworth

Copy link
Copy Markdown
Contributor

Closes #17.

Removes the Google Tag Manager loader and inline dataLayer bootstrap from the shared HTML shell. Static verification now rejects external executable script URLs and the removed analytics markers on every generated route.

Full local npm run check passes: formatting, lint, types, docs drift, 12 unit tests, client build, 338-route SSG build, and static verification with 32,442 API anchors.

Copilot AI review requested due to automatic review settings July 26, 2026 17:32

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Removes third-party production analytics from the shared HTML shell and strengthens the static-output verification step to ensure generated routes don’t reintroduce external executable scripts or the removed analytics bootstrap.

Changes:

  • Removed Google Tag Manager loader and inline dataLayer bootstrap from index.html.
  • Added static verification assertions to fail builds that include external script src URLs or analytics markers in generated HTML.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
scripts/verify-static-output.ts Adds new static-output assertions to detect external executable scripts and removed analytics remnants.
index.html Removes Google Tag Manager and inline analytics bootstrap from the base HTML shell.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread scripts/verify-static-output.ts
@smiggleworth
smiggleworth merged commit 83c4593 into main Jul 26, 2026
1 check passed
@smiggleworth
smiggleworth deleted the fix/security-remove-production-analytics branch July 26, 2026 17:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security: remove production third-party analytics

2 participants