feat(analytics): self-hosted Umami tracker on keepsimple.io by manager · Pull Request #176 · keepsimpleio/KeepSimpleOSS

manager · 2026-08-12T14:21:54Z

Adds our self-hosted, cookieless Umami tracker to keepsimple.io alongside Mixpanel. Nothing is removed.

Script tag in _document.tsx, domain-scoped with data-domains so staging and preview traffic is not counted.
The site is already registered in our Umami instance.
Also commits the font passport block into CLAUDE.md, which was live in the working copy but never committed.

Why: the current Mixpanel plan blocks API access (402 on every query endpoint), so no automation can read our own product numbers. Umami gives machine-readable data for free, and its self-hosted v3 covers funnels, retention, journeys and goals.

Merging this branch into dev builds the staging image; production only follows on a later merge to main.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:22:11Z

Claude finished @manager's task in 1m 15s —— View job

Review: PR #176 — self-hosted Umami tracker

Gather context (diff, files, AGENTS.md conventions)
Review _document.tsx changes (SSR safety, script placement, security)
Review CLAUDE.md diff (font passport block)
Post review feedback

⚠️ Security concern (blocking, please confirm before merge)

I left an inline comment on src/pages/_document.tsx:18: the script tag loads from https://analytics.administration.ae/script.js, which does not match keepsimple.io or any KeepSimple-owned domain I can find in this repo. The PR describes this as "self-hosted," but the script origin is an unrelated third-party domain. This unconditionally injects remote JS with full page/DOM access on every render (dev, staging, prod) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (src/pages/_app.tsx:48,147,236). data-domains only scopes what Umami records, it doesn't stop the script from executing.

Please double-check that analytics.administration.ae is the intended, trusted, KeepSimple-controlled endpoint before this merges. If confirmed correct, still worth considering:

Move src / data-website-id into env vars (NEXT_PUBLIC_UMAMI_*) instead of hardcoding, consistent with how the other trackers are configured per-environment.
SRI (integrity attribute) if the host serves a versioned/immutable script, since it's unauthenticated and loads on every page.

Other notes

SSR/hydration: no issues — this is a plain <script> tag in Head, server-rendered, no window/localStorage access at module scope.
Project conventions: no App Router, Tailwind, or barrel-file violations. Nothing else in the diff touches component/data patterns.
CLAUDE.md font-passport block: pure documentation addition, no functional impact. Minor nit: it's inserted above the # CLAUDE.md title rather than under a section — cosmetic only, not blocking.

No other correctness, accessibility, or styling issues found in this small diff.
· Branch: umami-setup

github-actions · 2026-08-12T14:23:28Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: third-party script domain doesn't match the "self-hosted" claim.
The PR description says this is a "self-hosted Umami tracker," but the script is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io or any KeepSimple-owned infrastructure I can find in this repo. That's a meaningful discrepancy:
This unconditionally injects third-party JS with full DOM/page access into <Head> on every render (dev, staging, prod, preview) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (see src/pages/_app.tsx:48,147,236). data-domains only filters what Umami records; it does not stop the script from loading and executing on every deploy.
A compromised or unverified third-party origin serving script.js here can read cookies/localStorage, exfiltrate data, or modify the DOM — full script-injection blast radius.
If this is genuinely self-hosted, the script origin should be KeepSimple-owned infra (e.g. analytics.keepsimple.io), not an unrelated third-party domain.
Please confirm analytics.administration.ae is an intentionally provisioned, trusted endpoint before merging. If it is, consider:
Sourcing the URL/website-id from an env var (NEXT_PUBLIC_UMAMI_*) rather than hardcoding, so staging/prod and endpoint rotation don't require code changes.
Adding integrity (SRI) if the endpoint supports versioned/immutable script hashes, since this loads on every page unauthenticated.
Fix this →

The Umami script tag shipped in #176 is blocked by our own CSP: neither script-src nor connect-src allows analytics.administration.ae, so browsers refuse to load the tracker and to send events. Adds the host to both.

manager · 2026-08-12T14:21:54Z

Adds our self-hosted, cookieless Umami tracker to keepsimple.io alongside Mixpanel. Nothing is removed.

Script tag in _document.tsx, domain-scoped with data-domains so staging and preview traffic is not counted.
The site is already registered in our Umami instance.
Also commits the font passport block into CLAUDE.md, which was live in the working copy but never committed.

Why: the current Mixpanel plan blocks API access (402 on every query endpoint), so no automation can read our own product numbers. Umami gives machine-readable data for free, and its self-hosted v3 covers funnels, retention, journeys and goals.

Merging this branch into dev builds the staging image; production only follows on a later merge to main.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:22:11Z

Claude finished @manager's task in 1m 15s —— View job

Review: PR #176 — self-hosted Umami tracker

Gather context (diff, files, AGENTS.md conventions)
Review _document.tsx changes (SSR safety, script placement, security)
Review CLAUDE.md diff (font passport block)
Post review feedback

⚠️ Security concern (blocking, please confirm before merge)

I left an inline comment on src/pages/_document.tsx:18: the script tag loads from https://analytics.administration.ae/script.js, which does not match keepsimple.io or any KeepSimple-owned domain I can find in this repo. The PR describes this as "self-hosted," but the script origin is an unrelated third-party domain. This unconditionally injects remote JS with full page/DOM access on every render (dev, staging, prod) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (src/pages/_app.tsx:48,147,236). data-domains only scopes what Umami records, it doesn't stop the script from executing.

Please double-check that analytics.administration.ae is the intended, trusted, KeepSimple-controlled endpoint before this merges. If confirmed correct, still worth considering:

Move src / data-website-id into env vars (NEXT_PUBLIC_UMAMI_*) instead of hardcoding, consistent with how the other trackers are configured per-environment.
SRI (integrity attribute) if the host serves a versioned/immutable script, since it's unauthenticated and loads on every page.

Other notes

SSR/hydration: no issues — this is a plain <script> tag in Head, server-rendered, no window/localStorage access at module scope.
Project conventions: no App Router, Tailwind, or barrel-file violations. Nothing else in the diff touches component/data patterns.
CLAUDE.md font-passport block: pure documentation addition, no functional impact. Minor nit: it's inserted above the # CLAUDE.md title rather than under a section — cosmetic only, not blocking.

No other correctness, accessibility, or styling issues found in this small diff.
· Branch: umami-setup

github-actions · 2026-08-12T14:23:28Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: third-party script domain doesn't match the "self-hosted" claim.
The PR description says this is a "self-hosted Umami tracker," but the script is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io or any KeepSimple-owned infrastructure I can find in this repo. That's a meaningful discrepancy:
This unconditionally injects third-party JS with full DOM/page access into <Head> on every render (dev, staging, prod, preview) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (see src/pages/_app.tsx:48,147,236). data-domains only filters what Umami records; it does not stop the script from loading and executing on every deploy.
A compromised or unverified third-party origin serving script.js here can read cookies/localStorage, exfiltrate data, or modify the DOM — full script-injection blast radius.
If this is genuinely self-hosted, the script origin should be KeepSimple-owned infra (e.g. analytics.keepsimple.io), not an unrelated third-party domain.
Please confirm analytics.administration.ae is an intentionally provisioned, trusted endpoint before merging. If it is, consider:
Sourcing the URL/website-id from an env var (NEXT_PUBLIC_UMAMI_*) rather than hardcoding, so staging/prod and endpoint rotation don't require code changes.
Adding integrity (SRI) if the endpoint supports versioned/immutable script hashes, since this loads on every page unauthenticated.
Fix this →

The Umami script tag shipped in #176 is blocked by our own CSP: neither script-src nor connect-src allows analytics.administration.ae, so browsers refuse to load the tracker and to send events. Adds the host to both.

manager · 2026-08-12T14:21:54Z

Adds our self-hosted, cookieless Umami tracker to keepsimple.io alongside Mixpanel. Nothing is removed.

Script tag in _document.tsx, domain-scoped with data-domains so staging and preview traffic is not counted.
The site is already registered in our Umami instance.
Also commits the font passport block into CLAUDE.md, which was live in the working copy but never committed.

Why: the current Mixpanel plan blocks API access (402 on every query endpoint), so no automation can read our own product numbers. Umami gives machine-readable data for free, and its self-hosted v3 covers funnels, retention, journeys and goals.

Merging this branch into dev builds the staging image; production only follows on a later merge to main.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:22:11Z

Claude finished @manager's task in 1m 15s —— View job

Review: PR #176 — self-hosted Umami tracker

Gather context (diff, files, AGENTS.md conventions)
Review _document.tsx changes (SSR safety, script placement, security)
Review CLAUDE.md diff (font passport block)
Post review feedback

⚠️ Security concern (blocking, please confirm before merge)

I left an inline comment on src/pages/_document.tsx:18: the script tag loads from https://analytics.administration.ae/script.js, which does not match keepsimple.io or any KeepSimple-owned domain I can find in this repo. The PR describes this as "self-hosted," but the script origin is an unrelated third-party domain. This unconditionally injects remote JS with full page/DOM access on every render (dev, staging, prod) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (src/pages/_app.tsx:48,147,236). data-domains only scopes what Umami records, it doesn't stop the script from executing.

Please double-check that analytics.administration.ae is the intended, trusted, KeepSimple-controlled endpoint before this merges. If confirmed correct, still worth considering:

Move src / data-website-id into env vars (NEXT_PUBLIC_UMAMI_*) instead of hardcoding, consistent with how the other trackers are configured per-environment.
SRI (integrity attribute) if the host serves a versioned/immutable script, since it's unauthenticated and loads on every page.

Other notes

SSR/hydration: no issues — this is a plain <script> tag in Head, server-rendered, no window/localStorage access at module scope.
Project conventions: no App Router, Tailwind, or barrel-file violations. Nothing else in the diff touches component/data patterns.
CLAUDE.md font-passport block: pure documentation addition, no functional impact. Minor nit: it's inserted above the # CLAUDE.md title rather than under a section — cosmetic only, not blocking.

No other correctness, accessibility, or styling issues found in this small diff.
· Branch: umami-setup

github-actions · 2026-08-12T14:23:28Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: third-party script domain doesn't match the "self-hosted" claim.
The PR description says this is a "self-hosted Umami tracker," but the script is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io or any KeepSimple-owned infrastructure I can find in this repo. That's a meaningful discrepancy:
This unconditionally injects third-party JS with full DOM/page access into <Head> on every render (dev, staging, prod, preview) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (see src/pages/_app.tsx:48,147,236). data-domains only filters what Umami records; it does not stop the script from loading and executing on every deploy.
A compromised or unverified third-party origin serving script.js here can read cookies/localStorage, exfiltrate data, or modify the DOM — full script-injection blast radius.
If this is genuinely self-hosted, the script origin should be KeepSimple-owned infra (e.g. analytics.keepsimple.io), not an unrelated third-party domain.
Please confirm analytics.administration.ae is an intentionally provisioned, trusted endpoint before merging. If it is, consider:
Sourcing the URL/website-id from an env var (NEXT_PUBLIC_UMAMI_*) rather than hardcoding, so staging/prod and endpoint rotation don't require code changes.
Adding integrity (SRI) if the endpoint supports versioned/immutable script hashes, since this loads on every page unauthenticated.
Fix this →

The Umami script tag shipped in #176 is blocked by our own CSP: neither script-src nor connect-src allows analytics.administration.ae, so browsers refuse to load the tracker and to send events. Adds the host to both.

manager · 2026-08-12T14:21:54Z

Adds our self-hosted, cookieless Umami tracker to keepsimple.io alongside Mixpanel. Nothing is removed.

Script tag in _document.tsx, domain-scoped with data-domains so staging and preview traffic is not counted.
The site is already registered in our Umami instance.
Also commits the font passport block into CLAUDE.md, which was live in the working copy but never committed.

Why: the current Mixpanel plan blocks API access (402 on every query endpoint), so no automation can read our own product numbers. Umami gives machine-readable data for free, and its self-hosted v3 covers funnels, retention, journeys and goals.

Merging this branch into dev builds the staging image; production only follows on a later merge to main.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:22:11Z

Claude finished @manager's task in 1m 15s —— View job

Review: PR #176 — self-hosted Umami tracker

Gather context (diff, files, AGENTS.md conventions)
Review _document.tsx changes (SSR safety, script placement, security)
Review CLAUDE.md diff (font passport block)
Post review feedback

⚠️ Security concern (blocking, please confirm before merge)

I left an inline comment on src/pages/_document.tsx:18: the script tag loads from https://analytics.administration.ae/script.js, which does not match keepsimple.io or any KeepSimple-owned domain I can find in this repo. The PR describes this as "self-hosted," but the script origin is an unrelated third-party domain. This unconditionally injects remote JS with full page/DOM access on every render (dev, staging, prod) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (src/pages/_app.tsx:48,147,236). data-domains only scopes what Umami records, it doesn't stop the script from executing.

Please double-check that analytics.administration.ae is the intended, trusted, KeepSimple-controlled endpoint before this merges. If confirmed correct, still worth considering:

Move src / data-website-id into env vars (NEXT_PUBLIC_UMAMI_*) instead of hardcoding, consistent with how the other trackers are configured per-environment.
SRI (integrity attribute) if the host serves a versioned/immutable script, since it's unauthenticated and loads on every page.

Other notes

SSR/hydration: no issues — this is a plain <script> tag in Head, server-rendered, no window/localStorage access at module scope.
Project conventions: no App Router, Tailwind, or barrel-file violations. Nothing else in the diff touches component/data patterns.
CLAUDE.md font-passport block: pure documentation addition, no functional impact. Minor nit: it's inserted above the # CLAUDE.md title rather than under a section — cosmetic only, not blocking.

No other correctness, accessibility, or styling issues found in this small diff.
· Branch: umami-setup

github-actions · 2026-08-12T14:23:28Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: third-party script domain doesn't match the "self-hosted" claim.
The PR description says this is a "self-hosted Umami tracker," but the script is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io or any KeepSimple-owned infrastructure I can find in this repo. That's a meaningful discrepancy:
This unconditionally injects third-party JS with full DOM/page access into <Head> on every render (dev, staging, prod, preview) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (see src/pages/_app.tsx:48,147,236). data-domains only filters what Umami records; it does not stop the script from loading and executing on every deploy.
A compromised or unverified third-party origin serving script.js here can read cookies/localStorage, exfiltrate data, or modify the DOM — full script-injection blast radius.
If this is genuinely self-hosted, the script origin should be KeepSimple-owned infra (e.g. analytics.keepsimple.io), not an unrelated third-party domain.
Please confirm analytics.administration.ae is an intentionally provisioned, trusted endpoint before merging. If it is, consider:
Sourcing the URL/website-id from an env var (NEXT_PUBLIC_UMAMI_*) rather than hardcoding, so staging/prod and endpoint rotation don't require code changes.
Adding integrity (SRI) if the endpoint supports versioned/immutable script hashes, since this loads on every page unauthenticated.
Fix this →

The Umami script tag shipped in #176 is blocked by our own CSP: neither script-src nor connect-src allows analytics.administration.ae, so browsers refuse to load the tracker and to send events. Adds the host to both.

manager · 2026-08-12T14:21:54Z

Adds our self-hosted, cookieless Umami tracker to keepsimple.io alongside Mixpanel. Nothing is removed.

Script tag in _document.tsx, domain-scoped with data-domains so staging and preview traffic is not counted.
The site is already registered in our Umami instance.
Also commits the font passport block into CLAUDE.md, which was live in the working copy but never committed.

Why: the current Mixpanel plan blocks API access (402 on every query endpoint), so no automation can read our own product numbers. Umami gives machine-readable data for free, and its self-hosted v3 covers funnels, retention, journeys and goals.

Merging this branch into dev builds the staging image; production only follows on a later merge to main.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:22:11Z

Claude finished @manager's task in 1m 15s —— View job

Review: PR #176 — self-hosted Umami tracker

Gather context (diff, files, AGENTS.md conventions)
Review _document.tsx changes (SSR safety, script placement, security)
Review CLAUDE.md diff (font passport block)
Post review feedback

⚠️ Security concern (blocking, please confirm before merge)

I left an inline comment on src/pages/_document.tsx:18: the script tag loads from https://analytics.administration.ae/script.js, which does not match keepsimple.io or any KeepSimple-owned domain I can find in this repo. The PR describes this as "self-hosted," but the script origin is an unrelated third-party domain. This unconditionally injects remote JS with full page/DOM access on every render (dev, staging, prod) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (src/pages/_app.tsx:48,147,236). data-domains only scopes what Umami records, it doesn't stop the script from executing.

Please double-check that analytics.administration.ae is the intended, trusted, KeepSimple-controlled endpoint before this merges. If confirmed correct, still worth considering:

Move src / data-website-id into env vars (NEXT_PUBLIC_UMAMI_*) instead of hardcoding, consistent with how the other trackers are configured per-environment.
SRI (integrity attribute) if the host serves a versioned/immutable script, since it's unauthenticated and loads on every page.

Other notes

SSR/hydration: no issues — this is a plain <script> tag in Head, server-rendered, no window/localStorage access at module scope.
Project conventions: no App Router, Tailwind, or barrel-file violations. Nothing else in the diff touches component/data patterns.
CLAUDE.md font-passport block: pure documentation addition, no functional impact. Minor nit: it's inserted above the # CLAUDE.md title rather than under a section — cosmetic only, not blocking.

No other correctness, accessibility, or styling issues found in this small diff.
· Branch: umami-setup

github-actions · 2026-08-12T14:23:28Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: third-party script domain doesn't match the "self-hosted" claim.
The PR description says this is a "self-hosted Umami tracker," but the script is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io or any KeepSimple-owned infrastructure I can find in this repo. That's a meaningful discrepancy:
This unconditionally injects third-party JS with full DOM/page access into <Head> on every render (dev, staging, prod, preview) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (see src/pages/_app.tsx:48,147,236). data-domains only filters what Umami records; it does not stop the script from loading and executing on every deploy.
A compromised or unverified third-party origin serving script.js here can read cookies/localStorage, exfiltrate data, or modify the DOM — full script-injection blast radius.
If this is genuinely self-hosted, the script origin should be KeepSimple-owned infra (e.g. analytics.keepsimple.io), not an unrelated third-party domain.
Please confirm analytics.administration.ae is an intentionally provisioned, trusted endpoint before merging. If it is, consider:
Sourcing the URL/website-id from an env var (NEXT_PUBLIC_UMAMI_*) rather than hardcoding, so staging/prod and endpoint rotation don't require code changes.
Adding integrity (SRI) if the endpoint supports versioned/immutable script hashes, since this loads on every page unauthenticated.
Fix this →

The Umami script tag shipped in #176 is blocked by our own CSP: neither script-src nor connect-src allows analytics.administration.ae, so browsers refuse to load the tracker and to send events. Adds the host to both.

manager · 2026-08-12T14:21:54Z

Adds our self-hosted, cookieless Umami tracker to keepsimple.io alongside Mixpanel. Nothing is removed.

Script tag in _document.tsx, domain-scoped with data-domains so staging and preview traffic is not counted.
The site is already registered in our Umami instance.
Also commits the font passport block into CLAUDE.md, which was live in the working copy but never committed.

Why: the current Mixpanel plan blocks API access (402 on every query endpoint), so no automation can read our own product numbers. Umami gives machine-readable data for free, and its self-hosted v3 covers funnels, retention, journeys and goals.

Merging this branch into dev builds the staging image; production only follows on a later merge to main.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:22:11Z

Claude finished @manager's task in 1m 15s —— View job

Review: PR #176 — self-hosted Umami tracker

Gather context (diff, files, AGENTS.md conventions)
Review _document.tsx changes (SSR safety, script placement, security)
Review CLAUDE.md diff (font passport block)
Post review feedback

⚠️ Security concern (blocking, please confirm before merge)

I left an inline comment on src/pages/_document.tsx:18: the script tag loads from https://analytics.administration.ae/script.js, which does not match keepsimple.io or any KeepSimple-owned domain I can find in this repo. The PR describes this as "self-hosted," but the script origin is an unrelated third-party domain. This unconditionally injects remote JS with full page/DOM access on every render (dev, staging, prod) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (src/pages/_app.tsx:48,147,236). data-domains only scopes what Umami records, it doesn't stop the script from executing.

Please double-check that analytics.administration.ae is the intended, trusted, KeepSimple-controlled endpoint before this merges. If confirmed correct, still worth considering:

Move src / data-website-id into env vars (NEXT_PUBLIC_UMAMI_*) instead of hardcoding, consistent with how the other trackers are configured per-environment.
SRI (integrity attribute) if the host serves a versioned/immutable script, since it's unauthenticated and loads on every page.

Other notes

SSR/hydration: no issues — this is a plain <script> tag in Head, server-rendered, no window/localStorage access at module scope.
Project conventions: no App Router, Tailwind, or barrel-file violations. Nothing else in the diff touches component/data patterns.
CLAUDE.md font-passport block: pure documentation addition, no functional impact. Minor nit: it's inserted above the # CLAUDE.md title rather than under a section — cosmetic only, not blocking.

No other correctness, accessibility, or styling issues found in this small diff.
· Branch: umami-setup

github-actions · 2026-08-12T14:23:28Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: third-party script domain doesn't match the "self-hosted" claim.
The PR description says this is a "self-hosted Umami tracker," but the script is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io or any KeepSimple-owned infrastructure I can find in this repo. That's a meaningful discrepancy:
This unconditionally injects third-party JS with full DOM/page access into <Head> on every render (dev, staging, prod, preview) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (see src/pages/_app.tsx:48,147,236). data-domains only filters what Umami records; it does not stop the script from loading and executing on every deploy.
A compromised or unverified third-party origin serving script.js here can read cookies/localStorage, exfiltrate data, or modify the DOM — full script-injection blast radius.
If this is genuinely self-hosted, the script origin should be KeepSimple-owned infra (e.g. analytics.keepsimple.io), not an unrelated third-party domain.
Please confirm analytics.administration.ae is an intentionally provisioned, trusted endpoint before merging. If it is, consider:
Sourcing the URL/website-id from an env var (NEXT_PUBLIC_UMAMI_*) rather than hardcoding, so staging/prod and endpoint rotation don't require code changes.
Adding integrity (SRI) if the endpoint supports versioned/immutable script hashes, since this loads on every page unauthenticated.
Fix this →

The Umami script tag shipped in #176 is blocked by our own CSP: neither script-src nor connect-src allows analytics.administration.ae, so browsers refuse to load the tracker and to send events. Adds the host to both.

manager · 2026-08-12T14:21:54Z

Adds our self-hosted, cookieless Umami tracker to keepsimple.io alongside Mixpanel. Nothing is removed.

Script tag in _document.tsx, domain-scoped with data-domains so staging and preview traffic is not counted.
The site is already registered in our Umami instance.
Also commits the font passport block into CLAUDE.md, which was live in the working copy but never committed.

Why: the current Mixpanel plan blocks API access (402 on every query endpoint), so no automation can read our own product numbers. Umami gives machine-readable data for free, and its self-hosted v3 covers funnels, retention, journeys and goals.

Merging this branch into dev builds the staging image; production only follows on a later merge to main.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:22:11Z

Claude finished @manager's task in 1m 15s —— View job

Review: PR #176 — self-hosted Umami tracker

Gather context (diff, files, AGENTS.md conventions)
Review _document.tsx changes (SSR safety, script placement, security)
Review CLAUDE.md diff (font passport block)
Post review feedback

⚠️ Security concern (blocking, please confirm before merge)

I left an inline comment on src/pages/_document.tsx:18: the script tag loads from https://analytics.administration.ae/script.js, which does not match keepsimple.io or any KeepSimple-owned domain I can find in this repo. The PR describes this as "self-hosted," but the script origin is an unrelated third-party domain. This unconditionally injects remote JS with full page/DOM access on every render (dev, staging, prod) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (src/pages/_app.tsx:48,147,236). data-domains only scopes what Umami records, it doesn't stop the script from executing.

Please double-check that analytics.administration.ae is the intended, trusted, KeepSimple-controlled endpoint before this merges. If confirmed correct, still worth considering:

Move src / data-website-id into env vars (NEXT_PUBLIC_UMAMI_*) instead of hardcoding, consistent with how the other trackers are configured per-environment.
SRI (integrity attribute) if the host serves a versioned/immutable script, since it's unauthenticated and loads on every page.

Other notes

SSR/hydration: no issues — this is a plain <script> tag in Head, server-rendered, no window/localStorage access at module scope.
Project conventions: no App Router, Tailwind, or barrel-file violations. Nothing else in the diff touches component/data patterns.
CLAUDE.md font-passport block: pure documentation addition, no functional impact. Minor nit: it's inserted above the # CLAUDE.md title rather than under a section — cosmetic only, not blocking.

No other correctness, accessibility, or styling issues found in this small diff.
· Branch: umami-setup

github-actions · 2026-08-12T14:23:28Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: third-party script domain doesn't match the "self-hosted" claim.
The PR description says this is a "self-hosted Umami tracker," but the script is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io or any KeepSimple-owned infrastructure I can find in this repo. That's a meaningful discrepancy:
This unconditionally injects third-party JS with full DOM/page access into <Head> on every render (dev, staging, prod, preview) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (see src/pages/_app.tsx:48,147,236). data-domains only filters what Umami records; it does not stop the script from loading and executing on every deploy.
A compromised or unverified third-party origin serving script.js here can read cookies/localStorage, exfiltrate data, or modify the DOM — full script-injection blast radius.
If this is genuinely self-hosted, the script origin should be KeepSimple-owned infra (e.g. analytics.keepsimple.io), not an unrelated third-party domain.
Please confirm analytics.administration.ae is an intentionally provisioned, trusted endpoint before merging. If it is, consider:
Sourcing the URL/website-id from an env var (NEXT_PUBLIC_UMAMI_*) rather than hardcoding, so staging/prod and endpoint rotation don't require code changes.
Adding integrity (SRI) if the endpoint supports versioned/immutable script hashes, since this loads on every page unauthenticated.
Fix this →

The Umami script tag shipped in #176 is blocked by our own CSP: neither script-src nor connect-src allows analytics.administration.ae, so browsers refuse to load the tracker and to send events. Adds the host to both.

manager · 2026-08-12T14:21:54Z

Adds our self-hosted, cookieless Umami tracker to keepsimple.io alongside Mixpanel. Nothing is removed.

Script tag in _document.tsx, domain-scoped with data-domains so staging and preview traffic is not counted.
The site is already registered in our Umami instance.
Also commits the font passport block into CLAUDE.md, which was live in the working copy but never committed.

Why: the current Mixpanel plan blocks API access (402 on every query endpoint), so no automation can read our own product numbers. Umami gives machine-readable data for free, and its self-hosted v3 covers funnels, retention, journeys and goals.

Merging this branch into dev builds the staging image; production only follows on a later merge to main.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:22:11Z

Claude finished @manager's task in 1m 15s —— View job

Review: PR #176 — self-hosted Umami tracker

Gather context (diff, files, AGENTS.md conventions)
Review _document.tsx changes (SSR safety, script placement, security)
Review CLAUDE.md diff (font passport block)
Post review feedback

⚠️ Security concern (blocking, please confirm before merge)

I left an inline comment on src/pages/_document.tsx:18: the script tag loads from https://analytics.administration.ae/script.js, which does not match keepsimple.io or any KeepSimple-owned domain I can find in this repo. The PR describes this as "self-hosted," but the script origin is an unrelated third-party domain. This unconditionally injects remote JS with full page/DOM access on every render (dev, staging, prod) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (src/pages/_app.tsx:48,147,236). data-domains only scopes what Umami records, it doesn't stop the script from executing.

Please double-check that analytics.administration.ae is the intended, trusted, KeepSimple-controlled endpoint before this merges. If confirmed correct, still worth considering:

Move src / data-website-id into env vars (NEXT_PUBLIC_UMAMI_*) instead of hardcoding, consistent with how the other trackers are configured per-environment.
SRI (integrity attribute) if the host serves a versioned/immutable script, since it's unauthenticated and loads on every page.

Other notes

SSR/hydration: no issues — this is a plain <script> tag in Head, server-rendered, no window/localStorage access at module scope.
Project conventions: no App Router, Tailwind, or barrel-file violations. Nothing else in the diff touches component/data patterns.
CLAUDE.md font-passport block: pure documentation addition, no functional impact. Minor nit: it's inserted above the # CLAUDE.md title rather than under a section — cosmetic only, not blocking.

No other correctness, accessibility, or styling issues found in this small diff.
· Branch: umami-setup

github-actions · 2026-08-12T14:23:28Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: third-party script domain doesn't match the "self-hosted" claim.
The PR description says this is a "self-hosted Umami tracker," but the script is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io or any KeepSimple-owned infrastructure I can find in this repo. That's a meaningful discrepancy:
This unconditionally injects third-party JS with full DOM/page access into <Head> on every render (dev, staging, prod, preview) — unlike GA/Mixpanel, which are lazy-loaded and gated behind NEXT_PUBLIC_INDEXING (see src/pages/_app.tsx:48,147,236). data-domains only filters what Umami records; it does not stop the script from loading and executing on every deploy.
A compromised or unverified third-party origin serving script.js here can read cookies/localStorage, exfiltrate data, or modify the DOM — full script-injection blast radius.
If this is genuinely self-hosted, the script origin should be KeepSimple-owned infra (e.g. analytics.keepsimple.io), not an unrelated third-party domain.
Please confirm analytics.administration.ae is an intentionally provisioned, trusted endpoint before merging. If it is, consider:
Sourcing the URL/website-id from an env var (NEXT_PUBLIC_UMAMI_*) rather than hardcoding, so staging/prod and endpoint rotation don't require code changes.
Adding integrity (SRI) if the endpoint supports versioned/immutable script hashes, since this loads on every page unauthenticated.
Fix this →

The Umami script tag shipped in #176 is blocked by our own CSP: neither script-src nor connect-src allows analytics.administration.ae, so browsers refuse to load the tracker and to send events. Adds the host to both.

github-actionsBot reviewed Aug 12, 2026
View reviewed changes

manager merged commit 0d9a565 into devAug 12, 2026
2 checks passed

manager mentioned this pull request Aug 12, 2026
fix(csp): allow the self-hosted Umami tracker #178
Merged

manager mentioned this pull request Aug 12, 2026
release: allow the Umami tracker in CSP #179
Merged