From 9a3724d4db56ecd2638c65bd649e40ab4e327e90 Mon Sep 17 00:00:00 2001 From: Sarthak Agrawal <43884471+sarthakagrawal927@users.noreply.github.com> Date: Wed, 23 Sep 2026 10:13:33 +0530 Subject: [PATCH 1/5] Add CodeVetter Watchtower browser telemetry --- apps/landing-page-astro/public/app-health-log.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/landing-page-astro/public/app-health-log.js b/apps/landing-page-astro/public/app-health-log.js index 04abb5bf..0a91e7ad 100644 --- a/apps/landing-page-astro/public/app-health-log.js +++ b/apps/landing-page-astro/public/app-health-log.js @@ -3,7 +3,7 @@ // Logs tab at health.sassmaker.com. window.appHealthLog(event, options) is // available for custom events. Source: app-health/examples/dropin-log-client. (function () { - var KEY = "ahk_pub_41a2a7fb8d001a36fbe4a3bf4a2eaa5376a1c91c483622fa", ENV = "production", URL = "https://ingest.sassmaker.com/v1/logs"; + var KEY = "ahk_pub_43b8473a6373800b1c7fac50ccac5c3d5ab760ea53b4f80e65dd981871bfae3f", ENV = "production", URL = "https://ingest.sassmaker.com/v1/logs"; function id() { return crypto.randomUUID(); } function send(event, o) { o = o || {}; From 60c1585a646838fe11f425eeb6cc5c9009ef067b Mon Sep 17 00:00:00 2001 From: Sarthak Agrawal <43884471+sarthakagrawal927@users.noreply.github.com> Date: Wed, 23 Sep 2026 10:13:39 +0530 Subject: [PATCH 2/5] Add CodeVetter Watchtower browser telemetry (apps/landing-page-astro/src/layouts) --- apps/landing-page-astro/src/layouts/Layout.astro | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/apps/landing-page-astro/src/layouts/Layout.astro b/apps/landing-page-astro/src/layouts/Layout.astro index 4f03f468..c5ac01a6 100644 --- a/apps/landing-page-astro/src/layouts/Layout.astro +++ b/apps/landing-page-astro/src/layouts/Layout.astro @@ -95,6 +95,15 @@ const OG_IMAGE = `${SITE_URL}/og-image.png`; !function(t,e){var o,n,p,r;e.__SV||(window.posthog=e,e._i=[],e.init=function(i,s,a){function g(t,e){var o=e.split(".");2==o.length&&(t=t[o[0]],e=o[1]),t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}}(p=t.createElement("script")).type="text/javascript",p.crossOrigin="anonymous",p.async=!0,p.src=s.api_host.replace(".i.posthog.com","-assets.i.posthog.com")+"/static/array.js",(r=t.getElementsByTagName("script")[0]).parentNode.insertBefore(p,r);var u=e;for(void 0!==a?u=e[a]=[]:a="posthog",u.people=u.people||[],u.toString=function(t){var e="posthog";return"posthog"!==a&&(e+="."+a),t||(e+=" (stub)"),e},u.people.toString=function(){return u.toString(1)+".people (stub)"},o="init capture register register_once register_for_session unregister unregister_for_session getFeatureFlag getFeatureFlagResult isFeatureEnabled reloadFeatureFlags updateEarlyAccessFeatureEnrollment getEarlyAccessFeatures on onFeatureFlags onSessionId getSurveys getActiveMatchingSurveys renderSurvey canRenderSurvey getNextSurveyStep identify setPersonProperties group resetGroups setPersonPropertiesForFlags resetPersonPropertiesForFlags setGroupPropertiesForFlags resetGroupPropertiesForFlags reset get_distinct_id getGroups get_session_id get_session_replay_url alias set_config startSessionRecording stopSessionRecording sessionRecordingStarted captureException loadToolbar get_property getSessionProperty createPersonProfile opt_in_capturing opt_out_capturing has_opted_in_capturing has_opted_out_capturing clear_opt_in_out_capturing debug".split(" "),n=0;n + From c7c7e4539b82a00433bad1e2cd8283ab31524451 Mon Sep 17 00:00:00 2001 From: Sarthak Agrawal <43884471+sarthakagrawal927@users.noreply.github.com> Date: Wed, 23 Sep 2026 10:13:46 +0530 Subject: [PATCH 3/5] Add CodeVetter Watchtower browser telemetry (root) --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index f02f608c..832533e7 100644 --- a/package.json +++ b/package.json @@ -87,7 +87,7 @@ "test:retrieval": "node --test scripts/context-retrieval/*.test.mjs scripts/context-retrieval/adapters/*.test.mjs", "test:runtime-failure-capsule": "node --test scripts/runtime-failure-capsule/*.test.mjs", "test:verification-receipts": "node --test scripts/verification-receipts/*.test.mjs", - "test:automation": "node --test scripts/emit-foundry-receipt.test.mjs scripts/run-biome-sarif.test.mjs", + "test:automation": "node --test scripts/app-health-landing.test.mjs scripts/emit-foundry-receipt.test.mjs scripts/run-biome-sarif.test.mjs", "test:native-data-continuity": "node --test scripts/qualify-native-data-continuity.test.mjs", "test:native-installed-upgrade": "node --test scripts/qualify-native-installed-upgrade.test.mjs", "test:native-package": "node --test scripts/qualify-native-package.test.mjs", From 0510a7ed2abfc7c80cd0cdeb40c03f8de7d8d743 Mon Sep 17 00:00:00 2001 From: Sarthak Agrawal <43884471+sarthakagrawal927@users.noreply.github.com> Date: Wed, 23 Sep 2026 10:13:51 +0530 Subject: [PATCH 4/5] Add CodeVetter Watchtower browser telemetry (scripts) --- scripts/app-health-landing.test.mjs | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 scripts/app-health-landing.test.mjs diff --git a/scripts/app-health-landing.test.mjs b/scripts/app-health-landing.test.mjs new file mode 100644 index 00000000..ed9d8c9e --- /dev/null +++ b/scripts/app-health-landing.test.mjs @@ -0,0 +1,21 @@ +import assert from 'node:assert/strict'; +import { readFile } from 'node:fs/promises'; +import test from 'node:test'; + +const layout = await readFile( + new URL('../apps/landing-page-astro/src/layouts/Layout.astro', import.meta.url), + 'utf8' +); +const logger = await readFile( + new URL('../apps/landing-page-astro/public/app-health-log.js', import.meta.url), + 'utf8' +); +const publicKey = 'ahk_pub_43b8473a6373800b1c7fac50ccac5c3d5ab760ea53b4f80e65dd981871bfae3f'; + +test('the landing page uses one origin-bound App Health project', () => { + assert.equal((layout.match(/health\.sassmaker\.com\/tracker\.js/g) ?? []).length, 1); + assert.match(layout, new RegExp(`data-key="${publicKey}"`)); + assert.match(layout, /data-project="app-963a6a0e-a082-4f60-a87a-b1b457bfc49a"/); + assert.match(layout, /data-endpoint="https:\/\/ingest\.sassmaker\.com\/v1\/browser"/); + assert.match(logger, new RegExp(publicKey)); +}); From 436f447e9bf48defc4004612469841465e789ea6 Mon Sep 17 00:00:00 2001 From: Sarthak Agrawal <43884471+sarthakagrawal927@users.noreply.github.com> Date: Wed, 23 Sep 2026 10:25:30 +0530 Subject: [PATCH 5/5] Allowlist exact public Watchtower key findings --- .gitleaksignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitleaksignore b/.gitleaksignore index 272af634..3d123c2c 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -11,3 +11,5 @@ benchmarks/repo-unpacks/n8n.json:generic-api-key:37594 benchmarks/repo-unpacks/n8n.json:generic-api-key:37846 apps/landing-page-astro/src/data/unpack-reports.json:generic-api-key:68635 apps/landing-page-astro/src/data/unpack-reports.json:generic-api-key:68887 +9a3724d4db56ecd2638c65bd649e40ab4e327e90:apps/landing-page-astro/public/app-health-log.js:generic-api-key:6 +60c1585a646838fe11f425eeb6cc5c9009ef067b:apps/landing-page-astro/src/layouts/Layout.astro:generic-api-key:102