[Medium] quick-type activity tracking serializes full settings into metadata (privacy/size) #67

New Issue

2026-05-05T04:16:12Z

spikerj commented

2026-05-05 04:16:12 +00:00

Severity: Medium (privacy/perf)

File: spikersoft-angular/libraries/tools/src/components/quick-type/quick-type.component.ts (~734)

Problem: Obfuscation tracking sends JSON.stringify(settings) in activity metadata. This can be large and leaks user's obfuscation preferences into analytics.

Fix: Either omit detail entirely or send a hash/summary (e.g. { profileName, settingsHash }) instead of the full settings object.

Acceptance criteria:

Activity metadata payload doesn't contain full settings JSON
Sufficient signal retained for analytics (e.g. profile/preset name)
Bundle size of metadata field bounded

**Severity:** Medium (privacy/perf) **File:** `spikersoft-angular/libraries/tools/src/components/quick-type/quick-type.component.ts` (~734) **Problem:** Obfuscation tracking sends `JSON.stringify(settings)` in activity metadata. This can be large and leaks user's obfuscation preferences into analytics. **Fix:** Either omit detail entirely or send a hash/summary (e.g. `{ profileName, settingsHash }`) instead of the full settings object. **Acceptance criteria:** - [ ] Activity metadata payload doesn't contain full settings JSON - [ ] Sufficient signal retained for analytics (e.g. profile/preset name) - [ ] Bundle size of metadata field bounded

spikerj commented

2026-05-05 04:47:09 +00:00

Resolved.

Added summarizeObfuscationSettings(settings) private helper. It walks the boolean flags on the settings object and returns:

{ enabledCount: number, totalToggles: number, enabled: string[/* up to 12 names */] }

The obfuscate tracking call now passes that summary instead of JSON.stringify(settings). The full settings object never leaves the client; metadata is bounded.

File: spikersoft-angular/libraries/tools/src/components/quick-type/quick-type.component.ts.

**Resolved.** Added `summarizeObfuscationSettings(settings)` private helper. It walks the boolean flags on the settings object and returns: ``` { enabledCount: number, totalToggles: number, enabled: string[/* up to 12 names */] } ``` The obfuscate tracking call now passes that summary instead of `JSON.stringify(settings)`. The full settings object never leaves the client; metadata is bounded. File: `spikersoft-angular/libraries/tools/src/components/quick-type/quick-type.component.ts`.

spikerj closed this issue

2026-05-05 04:51:57 +00:00

spikerj referenced this issue

2026-06-17 20:40:43 +00:00

chore(deps): Blockly 12 → 13 (major) #232

spikerj referenced this issue

2026-07-04 17:17:05 +00:00

[ArtStudio P3] Concept + texturing stages — SDXL concept image with safety checker, PBR texturing, stage chaining #349

spikerj referenced this issue

2026-07-04 18:44:04 +00:00

[ArtStudio] Safety gate false-positives on texture atlases — Character plan fails at texturing at threshold 0.3 #362

spikerj referenced this issue