Skip to content

Verify Freighter connection flow doesn't leak public keys to third-party analytics #598

Description

@Marvell69

Description
Wallet connection is documented elsewhere in the project as emitting a "wallet connection analytics event." This needs auditing to confirm the analytics payload doesn't inadvertently include the full public key or other sensitive identifiers in a way that ends up in third-party analytics tooling logs beyond what's actually needed.

Requirements and context

  • Locate the analytics event emission code for wallet connection
  • Audit exactly what data is sent and to where
  • If the full G-address is sent, evaluate whether a hashed/truncated identifier would serve the same analytics purpose with less exposure

Suggested execution

git checkout -b fix/audit-wallet-analytics-data-exposure
  • Locate and audit the wallet connection analytics payload
  • Reduce exposure if a hashed/truncated identifier suffices

Example commit message
fix: reduce wallet address exposure in connection analytics events

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions