Skip to content

fix(csp): allow Promptwatch analytics domain in CSP - #7998

Merged
ankur-arch merged 1 commit into
mainfrom
fix/csp-allow-promptwatch
Jul 3, 2026
Merged

fix(csp): allow Promptwatch analytics domain in CSP#7998
ankur-arch merged 1 commit into
mainfrom
fix/csp-allow-promptwatch

Conversation

@vanrensbird

@vanrensbird vanrensbird commented Jul 3, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

What

Adds https://ingest.promptwatch.com to the script-src and connect-src CSP directives in all four apps (site, docs, blog, eclipse).

Why

Promptwatch visitor analytics (AI referrer tracking) stopped receiving data on 2026-05-06, dropping from 400-1,000 visits/day to zero. The timing matches #7864.

The Promptwatch snippet is correctly consent-gated: it ships as type="text/plain" and CookieYes activates it once a visitor grants analytics consent. But when CookieYes flips it live, the browser blocks it anyway because the CSP allows neither loading the script from ingest.promptwatch.com (script-src) nor sending events to it (connect-src). Other analytics vendors (GA, PostHog, LinkedIn, CookieYes itself) are allowlisted; Promptwatch is not.

Scope

  • One domain added to two directives per app, 8 lines total.
  • No change to the consent gating. Tracking still only runs for visitors who accept analytics cookies.

Verification

After deploy: accept analytics consent on prisma.io, confirm no CSP violations for ingest.promptwatch.com in the browser console, and check that visits appear in Promptwatch Visitor Analytics.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Security
    • Updated site security settings to allow a new trusted analytics/monitoring endpoint.
    • This helps pages load and communicate with the service without being blocked by browser security policies.

@vanrensbird @claude
fix(csp): allow Promptwatch analytics script and ingest endpoint
8f896d1 
Promptwatch visitor tracking stopped on 2026-05-06. The script is
consent-gated via CookieYes, but once activated the browser blocks it
because ingest.promptwatch.com is missing from script-src and
connect-src. Adds the domain to the CSP of all four apps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@vercel

vercel Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
blog Ready Ready Preview, Comment Jul 3, 2026 8:40am
docs Ready Ready Preview, Comment Jul 3, 2026 8:40am
eclipse Ready Ready Preview, Comment Jul 3, 2026 8:40am
site Ready Ready Preview, Comment Jul 3, 2026 8:40am

Request Review

@vanrensbird
vanrensbird requested a review from ankur-arch July 3, 2026 08:39
@coderabbitai

coderabbitai Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a3a8fc11-ba18-431d-9a12-a1f36feb76d2

📥 Commits

Reviewing files that changed from the base of the PR and between 0c7f2df and 8f896d1.

📒 Files selected for processing (4)
  • apps/blog/next.config.mjs
  • apps/docs/next.config.mjs
  • apps/eclipse/next.config.mjs
  • apps/site/next.config.mjs

Walkthrough

The Content Security Policy strings in four Next.js apps (blog, docs, eclipse, site) are each updated to include https://ingest.promptwatch.com as an allowed source under both the script-src and connect-src directives, with no other configuration changes.

Changes

CSP Allowlist Additions

Layer / File(s) Summary
Blog CSP update
apps/blog/next.config.mjs		 Adds https://ingest.promptwatch.com to script-src and connect-src in the CSP template.
Docs CSP update
apps/docs/next.config.mjs		 Adds https://ingest.promptwatch.com to script-src and connect-src in the CSP template.
Eclipse CSP update
apps/eclipse/next.config.mjs		 Adds https://ingest.promptwatch.com to script-src and connect-src in the CSP template.
Site CSP update
apps/site/next.config.mjs		 Adds https://ingest.promptwatch.com to script-src and connect-src in the CSP template.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Related PRs: None identified.

Suggested labels: security, csp, config

Suggested reviewers: None specified.

Poem

A rabbit hops through four config trees,
Adding one origin with practiced ease,
Script-src, connect-src, both get the nod,
For ingest.promptwatch, a policy prod,
Four files, one line each — a tidy little breeze! 🐇

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: allowing Promptwatch's domain in CSP.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@ankur-arch ankur-arch self-assigned this Jul 3, 2026
@ankur-arch
ankur-arch merged commit b057f0d into main Jul 3, 2026
16 of 17 checks passed
@ankur-arch
ankur-arch deleted the fix/csp-allow-promptwatch branch July 3, 2026 08:42
@argos-ci

argos-ci Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build Status Details Updated (UTC)
default (Inspect) ✅ No changes detected - Jul 3, 2026, 8:48 AM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ankur-arch ankur-arch ankur-arch approved these changes

Assignees

@ankur-arch ankur-arch

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@vanrensbird @ankur-arch