From a2514d20e053a59a188192b3bcdd5d7008592e52 Mon Sep 17 00:00:00 2001 From: sis0k0 Date: Fri, 4 Sep 2026 15:46:06 +0300 Subject: [PATCH] Read codespace telemetry URL from org secret instead of hardcoding it The tracking Cloud Function URL was hardcoded and publicly guessable/exposed in this file. The URL now comes from the CODESPACE_TELEMETRY_URL org Codespaces secret; the script no-ops if it's not set. --- .devcontainer/track.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.devcontainer/track.sh b/.devcontainer/track.sh index aceee18..f163429 100644 --- a/.devcontainer/track.sh +++ b/.devcontainer/track.sh @@ -2,7 +2,8 @@ # Best-effort telemetry: log a codespace lifecycle event. Never fails the caller. EVENT="${1:-unknown}" GIT_EMAIL="$(git config --get user.email 2>/dev/null || true)" -URL="https://us-central1-project-learning-fuel.cloudfunctions.net/trackCodespace" +URL="${CODESPACE_TELEMETRY_URL:-}" +[ -z "$URL" ] && exit 0 curl -fsS -m 5 -X POST "$URL" \ -H "Content-Type: application/json" \ -d "{\"event\":\"$EVENT\",\"codespace\":\"${CODESPACE_NAME:-}\",\"user\":\"${GITHUB_USER:-}\",\"gitEmail\":\"${GIT_EMAIL:-}\",\"repository\":\"${GITHUB_REPOSITORY:-mongodb-developer/FARM-Intro}\"}" \