release: Umami analytics on keepsimple.io by manager · Pull Request #177 · keepsimpleio/KeepSimpleOSS

manager · 2026-08-12T14:48:05Z

Ships the self-hosted, cookieless Umami tracker to production. Verified on staging: the tag is served, the site id matches our Umami instance, the tracker script and the collect endpoint are publicly reachable.

Only one commit ahead of main, two files: the script tag in _document.tsx and the font passport block in CLAUDE.md. Mixpanel is untouched and keeps running alongside.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:50:31Z

Claude finished @manager's task in 1m 37s —— View job

Reviewing PR #177

Gather context (diff, changed files)
Review src/pages/_document.tsx changes
Review CLAUDE.md changes
Post final review

Summary

This PR is small and clean: it adds the self-hosted Umami <script> tag to src/pages/_document.tsx and lands the "Font passport" block at the top of CLAUDE.md. Mixpanel and the existing dark-theme bootstrap script in _document.tsx are untouched.

Correctness / conventions

Placement is correct — a plain <script> tag in _document.tsx's <Head> is the right pattern for Pages Router (no App Router / next/script-in-_document issues).
data-domains="keepsimple.io,www.keepsimple.io" correctly scopes tracking away from staging/preview, matching the PR description.
data-website-id is a public Umami site identifier, not a secret — fine to commit.
No SSR/hydration risk introduced: the new script is a static tag, not a top-level window/localStorage access.
No violations of AGENTS.md conventions (no App Router patterns, no CSS-in-JS, no global CSS import outside _app.tsx, no state library added).
CLAUDE.md addition is just documentation (font-size/contrast passport) — no schema/data changes, nothing UX-Core-related.

Flagged (inline comment on src/pages/_document.tsx:18)
⚠️ The tracker script is served from analytics.administration.ae — a domain with no visible relation to keepsimple.io. Since this script executes on every page with full page access, and the PR describes it as "self-hosted," it's worth a maintainer confirming who actually owns/operates that domain before treating this as settled — third-party JS on an unrelated domain is a supply-chain trust boundary worth making explicit (e.g. proxying through a keepsimple.io subdomain). This isn't blocking since the PR is already merged and the PR description says it was verified reachable on staging, but flagging for follow-up.

No other issues found.

github-actions · 2026-08-12T14:52:10Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: unverified third-party script domain. The tracker is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io (no shared brand/naming, .ae ccTLD). For a "self-hosted Umami" instance I'd expect something like analytics.keepsimple.io or another domain the org visibly controls.
This script runs on every page load with full DOM/cookie/localStorage access (same origin as the rest of the page once executed), so if this domain isn't actually owned/controlled by the KeepSimple team, this is a supply-chain risk (script content, and therefore what it does, is entirely outside this repo's control and can change at any time server-side).
Since this is already merged and live in production, can someone confirm:
Who owns/operates analytics.administration.ae?
Is this a KeepSimple-controlled self-hosted Umami box, or a third-party analytics vendor operating under that domain?
If it's not directly controlled by the org, consider proxying /script.js and the collect endpoint through a keepsimple.io subdomain/rewrite so the trust boundary is explicit and the vendor can be swapped without a client-side domain change.

manager · 2026-08-12T14:48:05Z

Ships the self-hosted, cookieless Umami tracker to production. Verified on staging: the tag is served, the site id matches our Umami instance, the tracker script and the collect endpoint are publicly reachable.

Only one commit ahead of main, two files: the script tag in _document.tsx and the font passport block in CLAUDE.md. Mixpanel is untouched and keeps running alongside.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:50:31Z

Claude finished @manager's task in 1m 37s —— View job

Reviewing PR #177

Gather context (diff, changed files)
Review src/pages/_document.tsx changes
Review CLAUDE.md changes
Post final review

Summary

This PR is small and clean: it adds the self-hosted Umami <script> tag to src/pages/_document.tsx and lands the "Font passport" block at the top of CLAUDE.md. Mixpanel and the existing dark-theme bootstrap script in _document.tsx are untouched.

Correctness / conventions

Placement is correct — a plain <script> tag in _document.tsx's <Head> is the right pattern for Pages Router (no App Router / next/script-in-_document issues).
data-domains="keepsimple.io,www.keepsimple.io" correctly scopes tracking away from staging/preview, matching the PR description.
data-website-id is a public Umami site identifier, not a secret — fine to commit.
No SSR/hydration risk introduced: the new script is a static tag, not a top-level window/localStorage access.
No violations of AGENTS.md conventions (no App Router patterns, no CSS-in-JS, no global CSS import outside _app.tsx, no state library added).
CLAUDE.md addition is just documentation (font-size/contrast passport) — no schema/data changes, nothing UX-Core-related.

Flagged (inline comment on src/pages/_document.tsx:18)
⚠️ The tracker script is served from analytics.administration.ae — a domain with no visible relation to keepsimple.io. Since this script executes on every page with full page access, and the PR describes it as "self-hosted," it's worth a maintainer confirming who actually owns/operates that domain before treating this as settled — third-party JS on an unrelated domain is a supply-chain trust boundary worth making explicit (e.g. proxying through a keepsimple.io subdomain). This isn't blocking since the PR is already merged and the PR description says it was verified reachable on staging, but flagging for follow-up.

No other issues found.

github-actions · 2026-08-12T14:52:10Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: unverified third-party script domain. The tracker is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io (no shared brand/naming, .ae ccTLD). For a "self-hosted Umami" instance I'd expect something like analytics.keepsimple.io or another domain the org visibly controls.
This script runs on every page load with full DOM/cookie/localStorage access (same origin as the rest of the page once executed), so if this domain isn't actually owned/controlled by the KeepSimple team, this is a supply-chain risk (script content, and therefore what it does, is entirely outside this repo's control and can change at any time server-side).
Since this is already merged and live in production, can someone confirm:
Who owns/operates analytics.administration.ae?
Is this a KeepSimple-controlled self-hosted Umami box, or a third-party analytics vendor operating under that domain?
If it's not directly controlled by the org, consider proxying /script.js and the collect endpoint through a keepsimple.io subdomain/rewrite so the trust boundary is explicit and the vendor can be swapped without a client-side domain change.

manager · 2026-08-12T14:48:05Z

Ships the self-hosted, cookieless Umami tracker to production. Verified on staging: the tag is served, the site id matches our Umami instance, the tracker script and the collect endpoint are publicly reachable.

Only one commit ahead of main, two files: the script tag in _document.tsx and the font passport block in CLAUDE.md. Mixpanel is untouched and keeps running alongside.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:50:31Z

Claude finished @manager's task in 1m 37s —— View job

Reviewing PR #177

Gather context (diff, changed files)
Review src/pages/_document.tsx changes
Review CLAUDE.md changes
Post final review

Summary

This PR is small and clean: it adds the self-hosted Umami <script> tag to src/pages/_document.tsx and lands the "Font passport" block at the top of CLAUDE.md. Mixpanel and the existing dark-theme bootstrap script in _document.tsx are untouched.

Correctness / conventions

Placement is correct — a plain <script> tag in _document.tsx's <Head> is the right pattern for Pages Router (no App Router / next/script-in-_document issues).
data-domains="keepsimple.io,www.keepsimple.io" correctly scopes tracking away from staging/preview, matching the PR description.
data-website-id is a public Umami site identifier, not a secret — fine to commit.
No SSR/hydration risk introduced: the new script is a static tag, not a top-level window/localStorage access.
No violations of AGENTS.md conventions (no App Router patterns, no CSS-in-JS, no global CSS import outside _app.tsx, no state library added).
CLAUDE.md addition is just documentation (font-size/contrast passport) — no schema/data changes, nothing UX-Core-related.

Flagged (inline comment on src/pages/_document.tsx:18)
⚠️ The tracker script is served from analytics.administration.ae — a domain with no visible relation to keepsimple.io. Since this script executes on every page with full page access, and the PR describes it as "self-hosted," it's worth a maintainer confirming who actually owns/operates that domain before treating this as settled — third-party JS on an unrelated domain is a supply-chain trust boundary worth making explicit (e.g. proxying through a keepsimple.io subdomain). This isn't blocking since the PR is already merged and the PR description says it was verified reachable on staging, but flagging for follow-up.

No other issues found.

github-actions · 2026-08-12T14:52:10Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: unverified third-party script domain. The tracker is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io (no shared brand/naming, .ae ccTLD). For a "self-hosted Umami" instance I'd expect something like analytics.keepsimple.io or another domain the org visibly controls.
This script runs on every page load with full DOM/cookie/localStorage access (same origin as the rest of the page once executed), so if this domain isn't actually owned/controlled by the KeepSimple team, this is a supply-chain risk (script content, and therefore what it does, is entirely outside this repo's control and can change at any time server-side).
Since this is already merged and live in production, can someone confirm:
Who owns/operates analytics.administration.ae?
Is this a KeepSimple-controlled self-hosted Umami box, or a third-party analytics vendor operating under that domain?
If it's not directly controlled by the org, consider proxying /script.js and the collect endpoint through a keepsimple.io subdomain/rewrite so the trust boundary is explicit and the vendor can be swapped without a client-side domain change.

manager · 2026-08-12T14:48:05Z

Ships the self-hosted, cookieless Umami tracker to production. Verified on staging: the tag is served, the site id matches our Umami instance, the tracker script and the collect endpoint are publicly reachable.

Only one commit ahead of main, two files: the script tag in _document.tsx and the font passport block in CLAUDE.md. Mixpanel is untouched and keeps running alongside.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:50:31Z

Claude finished @manager's task in 1m 37s —— View job

Reviewing PR #177

Gather context (diff, changed files)
Review src/pages/_document.tsx changes
Review CLAUDE.md changes
Post final review

Summary

This PR is small and clean: it adds the self-hosted Umami <script> tag to src/pages/_document.tsx and lands the "Font passport" block at the top of CLAUDE.md. Mixpanel and the existing dark-theme bootstrap script in _document.tsx are untouched.

Correctness / conventions

Placement is correct — a plain <script> tag in _document.tsx's <Head> is the right pattern for Pages Router (no App Router / next/script-in-_document issues).
data-domains="keepsimple.io,www.keepsimple.io" correctly scopes tracking away from staging/preview, matching the PR description.
data-website-id is a public Umami site identifier, not a secret — fine to commit.
No SSR/hydration risk introduced: the new script is a static tag, not a top-level window/localStorage access.
No violations of AGENTS.md conventions (no App Router patterns, no CSS-in-JS, no global CSS import outside _app.tsx, no state library added).
CLAUDE.md addition is just documentation (font-size/contrast passport) — no schema/data changes, nothing UX-Core-related.

Flagged (inline comment on src/pages/_document.tsx:18)
⚠️ The tracker script is served from analytics.administration.ae — a domain with no visible relation to keepsimple.io. Since this script executes on every page with full page access, and the PR describes it as "self-hosted," it's worth a maintainer confirming who actually owns/operates that domain before treating this as settled — third-party JS on an unrelated domain is a supply-chain trust boundary worth making explicit (e.g. proxying through a keepsimple.io subdomain). This isn't blocking since the PR is already merged and the PR description says it was verified reachable on staging, but flagging for follow-up.

No other issues found.

github-actions · 2026-08-12T14:52:10Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: unverified third-party script domain. The tracker is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io (no shared brand/naming, .ae ccTLD). For a "self-hosted Umami" instance I'd expect something like analytics.keepsimple.io or another domain the org visibly controls.
This script runs on every page load with full DOM/cookie/localStorage access (same origin as the rest of the page once executed), so if this domain isn't actually owned/controlled by the KeepSimple team, this is a supply-chain risk (script content, and therefore what it does, is entirely outside this repo's control and can change at any time server-side).
Since this is already merged and live in production, can someone confirm:
Who owns/operates analytics.administration.ae?
Is this a KeepSimple-controlled self-hosted Umami box, or a third-party analytics vendor operating under that domain?
If it's not directly controlled by the org, consider proxying /script.js and the collect endpoint through a keepsimple.io subdomain/rewrite so the trust boundary is explicit and the vendor can be swapped without a client-side domain change.

manager · 2026-08-12T14:48:05Z

Ships the self-hosted, cookieless Umami tracker to production. Verified on staging: the tag is served, the site id matches our Umami instance, the tracker script and the collect endpoint are publicly reachable.

Only one commit ahead of main, two files: the script tag in _document.tsx and the font passport block in CLAUDE.md. Mixpanel is untouched and keeps running alongside.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:50:31Z

Claude finished @manager's task in 1m 37s —— View job

Reviewing PR #177

Gather context (diff, changed files)
Review src/pages/_document.tsx changes
Review CLAUDE.md changes
Post final review

Summary

This PR is small and clean: it adds the self-hosted Umami <script> tag to src/pages/_document.tsx and lands the "Font passport" block at the top of CLAUDE.md. Mixpanel and the existing dark-theme bootstrap script in _document.tsx are untouched.

Correctness / conventions

Placement is correct — a plain <script> tag in _document.tsx's <Head> is the right pattern for Pages Router (no App Router / next/script-in-_document issues).
data-domains="keepsimple.io,www.keepsimple.io" correctly scopes tracking away from staging/preview, matching the PR description.
data-website-id is a public Umami site identifier, not a secret — fine to commit.
No SSR/hydration risk introduced: the new script is a static tag, not a top-level window/localStorage access.
No violations of AGENTS.md conventions (no App Router patterns, no CSS-in-JS, no global CSS import outside _app.tsx, no state library added).
CLAUDE.md addition is just documentation (font-size/contrast passport) — no schema/data changes, nothing UX-Core-related.

Flagged (inline comment on src/pages/_document.tsx:18)
⚠️ The tracker script is served from analytics.administration.ae — a domain with no visible relation to keepsimple.io. Since this script executes on every page with full page access, and the PR describes it as "self-hosted," it's worth a maintainer confirming who actually owns/operates that domain before treating this as settled — third-party JS on an unrelated domain is a supply-chain trust boundary worth making explicit (e.g. proxying through a keepsimple.io subdomain). This isn't blocking since the PR is already merged and the PR description says it was verified reachable on staging, but flagging for follow-up.

No other issues found.

github-actions · 2026-08-12T14:52:10Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: unverified third-party script domain. The tracker is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io (no shared brand/naming, .ae ccTLD). For a "self-hosted Umami" instance I'd expect something like analytics.keepsimple.io or another domain the org visibly controls.
This script runs on every page load with full DOM/cookie/localStorage access (same origin as the rest of the page once executed), so if this domain isn't actually owned/controlled by the KeepSimple team, this is a supply-chain risk (script content, and therefore what it does, is entirely outside this repo's control and can change at any time server-side).
Since this is already merged and live in production, can someone confirm:
Who owns/operates analytics.administration.ae?
Is this a KeepSimple-controlled self-hosted Umami box, or a third-party analytics vendor operating under that domain?
If it's not directly controlled by the org, consider proxying /script.js and the collect endpoint through a keepsimple.io subdomain/rewrite so the trust boundary is explicit and the vendor can be swapped without a client-side domain change.

manager · 2026-08-12T14:48:05Z

Ships the self-hosted, cookieless Umami tracker to production. Verified on staging: the tag is served, the site id matches our Umami instance, the tracker script and the collect endpoint are publicly reachable.

Only one commit ahead of main, two files: the script tag in _document.tsx and the font passport block in CLAUDE.md. Mixpanel is untouched and keeps running alongside.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:50:31Z

Claude finished @manager's task in 1m 37s —— View job

Reviewing PR #177

Gather context (diff, changed files)
Review src/pages/_document.tsx changes
Review CLAUDE.md changes
Post final review

Summary

This PR is small and clean: it adds the self-hosted Umami <script> tag to src/pages/_document.tsx and lands the "Font passport" block at the top of CLAUDE.md. Mixpanel and the existing dark-theme bootstrap script in _document.tsx are untouched.

Correctness / conventions

Placement is correct — a plain <script> tag in _document.tsx's <Head> is the right pattern for Pages Router (no App Router / next/script-in-_document issues).
data-domains="keepsimple.io,www.keepsimple.io" correctly scopes tracking away from staging/preview, matching the PR description.
data-website-id is a public Umami site identifier, not a secret — fine to commit.
No SSR/hydration risk introduced: the new script is a static tag, not a top-level window/localStorage access.
No violations of AGENTS.md conventions (no App Router patterns, no CSS-in-JS, no global CSS import outside _app.tsx, no state library added).
CLAUDE.md addition is just documentation (font-size/contrast passport) — no schema/data changes, nothing UX-Core-related.

Flagged (inline comment on src/pages/_document.tsx:18)
⚠️ The tracker script is served from analytics.administration.ae — a domain with no visible relation to keepsimple.io. Since this script executes on every page with full page access, and the PR describes it as "self-hosted," it's worth a maintainer confirming who actually owns/operates that domain before treating this as settled — third-party JS on an unrelated domain is a supply-chain trust boundary worth making explicit (e.g. proxying through a keepsimple.io subdomain). This isn't blocking since the PR is already merged and the PR description says it was verified reachable on staging, but flagging for follow-up.

No other issues found.

github-actions · 2026-08-12T14:52:10Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: unverified third-party script domain. The tracker is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io (no shared brand/naming, .ae ccTLD). For a "self-hosted Umami" instance I'd expect something like analytics.keepsimple.io or another domain the org visibly controls.
This script runs on every page load with full DOM/cookie/localStorage access (same origin as the rest of the page once executed), so if this domain isn't actually owned/controlled by the KeepSimple team, this is a supply-chain risk (script content, and therefore what it does, is entirely outside this repo's control and can change at any time server-side).
Since this is already merged and live in production, can someone confirm:
Who owns/operates analytics.administration.ae?
Is this a KeepSimple-controlled self-hosted Umami box, or a third-party analytics vendor operating under that domain?
If it's not directly controlled by the org, consider proxying /script.js and the collect endpoint through a keepsimple.io subdomain/rewrite so the trust boundary is explicit and the vendor can be swapped without a client-side domain change.

manager · 2026-08-12T14:48:05Z

Ships the self-hosted, cookieless Umami tracker to production. Verified on staging: the tag is served, the site id matches our Umami instance, the tracker script and the collect endpoint are publicly reachable.

Only one commit ahead of main, two files: the script tag in _document.tsx and the font passport block in CLAUDE.md. Mixpanel is untouched and keeps running alongside.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:50:31Z

Claude finished @manager's task in 1m 37s —— View job

Reviewing PR #177

Gather context (diff, changed files)
Review src/pages/_document.tsx changes
Review CLAUDE.md changes
Post final review

Summary

This PR is small and clean: it adds the self-hosted Umami <script> tag to src/pages/_document.tsx and lands the "Font passport" block at the top of CLAUDE.md. Mixpanel and the existing dark-theme bootstrap script in _document.tsx are untouched.

Correctness / conventions

Placement is correct — a plain <script> tag in _document.tsx's <Head> is the right pattern for Pages Router (no App Router / next/script-in-_document issues).
data-domains="keepsimple.io,www.keepsimple.io" correctly scopes tracking away from staging/preview, matching the PR description.
data-website-id is a public Umami site identifier, not a secret — fine to commit.
No SSR/hydration risk introduced: the new script is a static tag, not a top-level window/localStorage access.
No violations of AGENTS.md conventions (no App Router patterns, no CSS-in-JS, no global CSS import outside _app.tsx, no state library added).
CLAUDE.md addition is just documentation (font-size/contrast passport) — no schema/data changes, nothing UX-Core-related.

Flagged (inline comment on src/pages/_document.tsx:18)
⚠️ The tracker script is served from analytics.administration.ae — a domain with no visible relation to keepsimple.io. Since this script executes on every page with full page access, and the PR describes it as "self-hosted," it's worth a maintainer confirming who actually owns/operates that domain before treating this as settled — third-party JS on an unrelated domain is a supply-chain trust boundary worth making explicit (e.g. proxying through a keepsimple.io subdomain). This isn't blocking since the PR is already merged and the PR description says it was verified reachable on staging, but flagging for follow-up.

No other issues found.

github-actions · 2026-08-12T14:52:10Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: unverified third-party script domain. The tracker is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io (no shared brand/naming, .ae ccTLD). For a "self-hosted Umami" instance I'd expect something like analytics.keepsimple.io or another domain the org visibly controls.
This script runs on every page load with full DOM/cookie/localStorage access (same origin as the rest of the page once executed), so if this domain isn't actually owned/controlled by the KeepSimple team, this is a supply-chain risk (script content, and therefore what it does, is entirely outside this repo's control and can change at any time server-side).
Since this is already merged and live in production, can someone confirm:
Who owns/operates analytics.administration.ae?
Is this a KeepSimple-controlled self-hosted Umami box, or a third-party analytics vendor operating under that domain?
If it's not directly controlled by the org, consider proxying /script.js and the collect endpoint through a keepsimple.io subdomain/rewrite so the trust boundary is explicit and the vendor can be swapped without a client-side domain change.

manager · 2026-08-12T14:48:05Z

Ships the self-hosted, cookieless Umami tracker to production. Verified on staging: the tag is served, the site id matches our Umami instance, the tracker script and the collect endpoint are publicly reachable.

Only one commit ahead of main, two files: the script tag in _document.tsx and the font passport block in CLAUDE.md. Mixpanel is untouched and keeps running alongside.

🤖 Generated with Claude Code

Cookieless Umami (analytics.administration.ae), domain-scoped to keepsimple.io + www so staging and preview traffic is not counted. Runs alongside Mixpanel; nothing removed. Also lands the font passport block in CLAUDE.md, which was live locally but never committed.

github-actions · 2026-08-12T14:50:31Z

Claude finished @manager's task in 1m 37s —— View job

Reviewing PR #177

Gather context (diff, changed files)
Review src/pages/_document.tsx changes
Review CLAUDE.md changes
Post final review

Summary

This PR is small and clean: it adds the self-hosted Umami <script> tag to src/pages/_document.tsx and lands the "Font passport" block at the top of CLAUDE.md. Mixpanel and the existing dark-theme bootstrap script in _document.tsx are untouched.

Correctness / conventions

Placement is correct — a plain <script> tag in _document.tsx's <Head> is the right pattern for Pages Router (no App Router / next/script-in-_document issues).
data-domains="keepsimple.io,www.keepsimple.io" correctly scopes tracking away from staging/preview, matching the PR description.
data-website-id is a public Umami site identifier, not a secret — fine to commit.
No SSR/hydration risk introduced: the new script is a static tag, not a top-level window/localStorage access.
No violations of AGENTS.md conventions (no App Router patterns, no CSS-in-JS, no global CSS import outside _app.tsx, no state library added).
CLAUDE.md addition is just documentation (font-size/contrast passport) — no schema/data changes, nothing UX-Core-related.

Flagged (inline comment on src/pages/_document.tsx:18)
⚠️ The tracker script is served from analytics.administration.ae — a domain with no visible relation to keepsimple.io. Since this script executes on every page with full page access, and the PR describes it as "self-hosted," it's worth a maintainer confirming who actually owns/operates that domain before treating this as settled — third-party JS on an unrelated domain is a supply-chain trust boundary worth making explicit (e.g. proxying through a keepsimple.io subdomain). This isn't blocking since the PR is already merged and the PR description says it was verified reachable on staging, but flagging for follow-up.

No other issues found.

github-actions · 2026-08-12T14:52:10Z

+ {/* Umami, self-hosted, cookieless. data-domains keeps preview/staging traffic out. */}
+ <script
+ defer
+ src="https://analytics.administration.ae/script.js"


Security: unverified third-party script domain. The tracker is loaded from analytics.administration.ae — a domain unrelated to keepsimple.io (no shared brand/naming, .ae ccTLD). For a "self-hosted Umami" instance I'd expect something like analytics.keepsimple.io or another domain the org visibly controls.
This script runs on every page load with full DOM/cookie/localStorage access (same origin as the rest of the page once executed), so if this domain isn't actually owned/controlled by the KeepSimple team, this is a supply-chain risk (script content, and therefore what it does, is entirely outside this repo's control and can change at any time server-side).
Since this is already merged and live in production, can someone confirm:
Who owns/operates analytics.administration.ae?
Is this a KeepSimple-controlled self-hosted Umami box, or a third-party analytics vendor operating under that domain?
If it's not directly controlled by the org, consider proxying /script.js and the collect endpoint through a keepsimple.io subdomain/rewrite so the trust boundary is explicit and the vendor can be swapped without a client-side domain change.

manager merged commit 80ad8d5 into mainAug 12, 2026
3 checks passed

github-actionsBot reviewed Aug 12, 2026
View reviewed changes