From 91f31c8547681b3dfd275158ece1aee76c4a9b08 Mon Sep 17 00:00:00 2001 From: sis0k0 Date: Fri, 4 Sep 2026 15:46:09 +0300 Subject: [PATCH] Read codespace telemetry URL from org secret instead of hardcoding it The tracking Cloud Function URL was hardcoded and publicly guessable/exposed in this file. The URL now comes from the CODESPACE_TELEMETRY_URL org Codespaces secret; the script no-ops if it's not set. --- .devcontainer/track.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.devcontainer/track.sh b/.devcontainer/track.sh index 7c2bc5c..bd64113 100644 --- a/.devcontainer/track.sh +++ b/.devcontainer/track.sh @@ -2,7 +2,8 @@ # Best-effort telemetry: log a codespace lifecycle event. Never fails the caller. EVENT="${1:-unknown}" GIT_EMAIL="$(git config --get user.email 2>/dev/null || true)" -URL="https://us-central1-project-learning-fuel.cloudfunctions.net/trackCodespace" +URL="${CODESPACE_TELEMETRY_URL:-}" +[ -z "$URL" ] && exit 0 curl -fsS -m 5 -X POST "$URL" \ -H "Content-Type: application/json" \ -d "{\"event\":\"$EVENT\",\"codespace\":\"${CODESPACE_NAME:-}\",\"user\":\"${GITHUB_USER:-}\",\"gitEmail\":\"${GIT_EMAIL:-}\",\"repository\":\"${GITHUB_REPOSITORY:-mongodb-developer/mern-stack-example}\"}" \