Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/components/layout.astro
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,7 @@ const organizationSchema = {
<>
<!-- @prettier-ignore -->
<script src="../scripts/analytics.js"></script>
<script src="../scripts/outbound.js"></script>
<script src="../scripts/cookieconsent.ts"></script>
</>
)
Expand Down
26 changes: 26 additions & 0 deletions src/scripts/outbound.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
import posthog from "posthog-js"

// Delegated, passive listener on document so it survives Astro client-side
// navigations (astro:page-load re-renders the DOM; per-link handlers would not).
// Captures clicks on github.com links only. posthog.capture() is a no-op-safe
// queue if PostHog isn't initialized yet (e.g. before consent), so no guard needed.
document.addEventListener(
"click",
(e) => {
// Early return first — this runs on every click on the page.
const link = e.target.closest("a[href]")
if (!link) return

const url = link.href
if (!url.includes("github.com")) return

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization High

'
github.com
' can be anywhere in the URL, and arbitrary hosts may come before or after it.
if (!/^https?:\/\//.test(url)) return

posthog.capture("outbound_click", {
url: url,
link_text: link.innerText?.trim().slice(0, 100) || null,
source_path: window.location.pathname,
target: link.target || "_self",
})
},
{ capture: true, passive: true },
)
Loading