From 8f896d1ccd8b8e5695398a5d98bd80a2bb04020b Mon Sep 17 00:00:00 2001 From: Martin Janse van Rensburg Date: Fri, 3 Jul 2026 10:31:57 +0200 Subject: [PATCH] fix(csp): allow Promptwatch analytics script and ingest endpoint Promptwatch visitor tracking stopped on 2026-05-06. The script is consent-gated via CookieYes, but once activated the browser blocks it because ingest.promptwatch.com is missing from script-src and connect-src. Adds the domain to the CSP of all four apps. Co-Authored-By: Claude Fable 5 --- apps/blog/next.config.mjs | 2 ++ apps/docs/next.config.mjs | 2 ++ apps/eclipse/next.config.mjs | 2 ++ apps/site/next.config.mjs | 2 ++ 4 files changed, 8 insertions(+) diff --git a/apps/blog/next.config.mjs b/apps/blog/next.config.mjs index aa11b2c9f6..c0367afb97 100644 --- a/apps/blog/next.config.mjs +++ b/apps/blog/next.config.mjs @@ -5,6 +5,7 @@ const withMDX = createMDX(); const ContentSecurityPolicy = ` default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' + https://ingest.promptwatch.com https://cdn-cookieyes.com https://cdn.tolt.io https://unpkg.com @@ -78,6 +79,7 @@ const ContentSecurityPolicy = ` https://raw.githubusercontent.com; connect-src 'self' + https://ingest.promptwatch.com https://api.github.com https://p2zxqf70.api.sanity.io https://www.youtube.com diff --git a/apps/docs/next.config.mjs b/apps/docs/next.config.mjs index cdf9cbca92..20040e9d02 100644 --- a/apps/docs/next.config.mjs +++ b/apps/docs/next.config.mjs @@ -6,6 +6,7 @@ const withMDX = createMDX(); const ContentSecurityPolicy = ` default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' + https://ingest.promptwatch.com https://cdn-cookieyes.com https://cdn.tolt.io https://unpkg.com @@ -84,6 +85,7 @@ const ContentSecurityPolicy = ` https://raw.githubusercontent.com; connect-src 'self' + https://ingest.promptwatch.com https://api.github.com https://p2zxqf70.api.sanity.io https://www.youtube.com diff --git a/apps/eclipse/next.config.mjs b/apps/eclipse/next.config.mjs index 8acf2e4a65..4b05b1b6c5 100644 --- a/apps/eclipse/next.config.mjs +++ b/apps/eclipse/next.config.mjs @@ -5,6 +5,7 @@ const withMDX = createMDX(); const ContentSecurityPolicy = ` default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' + https://ingest.promptwatch.com https://cdn-cookieyes.com https://cdn.tolt.io https://unpkg.com @@ -83,6 +84,7 @@ const ContentSecurityPolicy = ` https://raw.githubusercontent.com; connect-src 'self' + https://ingest.promptwatch.com https://api.github.com https://p2zxqf70.api.sanity.io https://www.youtube.com diff --git a/apps/site/next.config.mjs b/apps/site/next.config.mjs index 443f0c5fb8..b73d43b2a8 100644 --- a/apps/site/next.config.mjs +++ b/apps/site/next.config.mjs @@ -45,6 +45,7 @@ if ( const ContentSecurityPolicy = ` default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' + https://ingest.promptwatch.com https://cdn-cookieyes.com https://cdn.tolt.io https://unpkg.com @@ -123,6 +124,7 @@ const ContentSecurityPolicy = ` https://www.prisma.io; connect-src 'self' + https://ingest.promptwatch.com https://api.github.com https://p2zxqf70.api.sanity.io https://www.youtube.com