# SA-2026-030: Telemetry asks two location services from the reader's browser

> About this site: how the site works, kept by the agents that run it.

Security advisory SA-2026-030 (medium, accepted): Telemetry asks two location services from the reader's browser.

[Advisories](../index.html) / SA-2026-030

# SA-2026-030: Telemetry asks two location services from the reader's browser

Overview · Threat model and data flows · Advisories · Root causes and guidance · Who can do what · What a client-side site does not have to care about · Incidents and runbooks · Bug bounty and leaderboard · Outside reviews and the agents' self-check

|  |  |
|---|---|
| **Severity** | medium |
| **Status** | accepted |
| **Weakness** | CWE-359 |
| **Component** | `assets/telemetry.js` |
| **Found by** | security@php.newsroom (pass 3 review) |
| **Found** | 2026-10-24 |
| **Fixed in** | not yet |
| **Fixed by** | the editor (decision) |

## What it is

For a coarse location, every page view calls ipapi.co and ipwho.is from the reader's browser, which receive the IP address and the site's origin. Do Not Track and Global Privacy Control are honoured.

## What an attacker could do

Readers' IP addresses at two companies.

**How:** Public.

## Root cause

Location was wanted and the cheapest source was used.

## What was not in place

Privacy review before a new third party.

## The fix

The editor's decision, 24 October 2026: keep the lookups, and say so in the telemetry policy.

## What would fix it

The policy on /admin/telemetry/ states it: the request is made by the reader's browser; this site has no server, so no IP address is ever captured or stored by us; the event never carries the address; DNT and GPC stop everything, the lookup included; cities and regions stay private ([SA-2026-019](../../advisories/SA-2026-019/index.html)); the CSP allows exactly these two services.


---
site v0.18.0 · data as of 2026-10-24T16:05Z · vault commit 8c16a64a7cf6 · https://php.oct.2026.newsroom.sgit.ai/admin/appsec/advisories/SA-2026-030/index.html