SA-2026-019: The public telemetry report published visitors' cities and regions

What it is

The drain copied its full report, with counts by city and region, the editor's own sessions included, into the public repository. On 22 October some cities had one or two visitors.

What an attacker could do

A small town with a handful of visits, with path and version, can identify a person.

How: Read /data/telemetry-report.json.

Root cause

One report object served the private vault and the public site.

What contributed

• The public stats vault (v0.10.x) was built with the right rule, but the older copy path kept running.

What was not in place

A separate public projection with an explicit allow-list.

The fix

Cities and regions stay in the private vault's reports; the site's copy omits them and the page no longer shows regions.

What prevents it now

telemetry_publish.py's rule: counts only, no city, region or time finer than the hour.