fix(tracker): reject unsafe URLs and align docs

Author: izadoesdev

apps/docs/content/docs/Integrations/gtm.mdx

@@ -166,13 +166,7 @@ Send GTM data layer events to Databuddy:
 
 ## Triggers Configuration
 
-### Page View Tracking
-
-Create a trigger for enhanced page views:
-
-1. **Trigger Type**: Page View - DOM Ready
-2. **Trigger Name**: "Databuddy - Enhanced Page View"
-3. **Conditions**: Page Path contains your domain
+The analytics script records pageviews automatically, including SPA navigation. Use the **All Pages** trigger only to load the script; do not add a second pageview tag.
 
 ### Scroll Tracking
 

apps/docs/content/docs/sdk/configuration.mdx

@@ -21,7 +21,7 @@ This page documents all configuration options across the Databuddy SDK platforms
   scriptUrl="https://cdn.databuddy.cc/databuddy.js"
   
   // Core tracking
-  trackWebVitals          // default: false
+  trackWebVitals={true}   // opt in; default: false
   trackErrors             // default: false
   trackOutgoingLinks      // default: false
   trackInteractions       // default: false
@@ -65,13 +65,17 @@ This page documents all configuration options across the Databuddy SDK platforms
 
 | Prop | Type | Default | Description |
 |------|------|---------|-------------|
-| `trackWebVitals` | `boolean` | `false` | Core Web Vitals (LCP, INP, CLS, TTFB) |
+| `trackWebVitals` | `boolean` | `false` | FCP, LCP, INP, CLS, TTFB, and FPS |
 | `trackErrors` | `boolean` | `false` | JavaScript errors |
 | `trackOutgoingLinks` | `boolean` | `false` | External link clicks |
 | `trackInteractions` | `boolean` | `false` | Button clicks and form submissions |
 | `trackAttributes` | `boolean` | `false` | Elements with `data-track` attributes |
 | `trackHashChanges` | `boolean` | `false` | URL hash changes |
 
+<Callout type="info">
+  Use `trackWebVitals` in React, Vue, and Nuxt, or `data-track-web-vitals` with the CDN script. The older `trackPerformance` option remains a deprecated compatibility alias; `trackWebVitals` takes precedence when both are set.
+</Callout>
+
 #### Batching & Performance
 
 | Prop | Type | Default | Description |
@@ -139,7 +143,7 @@ Vue uses the same props as React but with kebab-case naming:
 | Attribute | Type | Default | Description |
 |-----------|------|---------|-------------|
 | `data-client-id` | `string` | Required | Your client ID |
-| `data-track-web-vitals` | flag | `false` | Track page performance and Core Web Vitals |
+| `data-track-web-vitals` | flag | `false` | FCP, LCP, INP, CLS, TTFB, and FPS |
 | `data-track-errors` | flag | `false` | Track JavaScript errors |
 | `data-track-outgoing-links` | flag | `false` | Track external links |
 | `data-track-interactions` | flag | `false` | Track interactions |

apps/docs/content/docs/sdk/nuxt.mdx

@@ -148,7 +148,7 @@ All options are passed under the `databuddy` key in `nuxt.config.ts`:
 | `clientId` | `string` | — | Your Databuddy client ID |
 | `disabled` | `boolean` | `false` | Disable all tracking |
 | `debug` | `boolean` | `false` | Enable verbose logging |
-| `trackWebVitals` | `boolean` | `false` | Core Web Vitals (LCP, CLS, TTFB) |
+| `trackWebVitals` | `boolean` | `false` | Core Web Vitals (LCP, INP, CLS, TTFB) |
 | `trackErrors` | `boolean` | `false` | JS errors + Vue component errors |
 | `trackOutgoingLinks` | `boolean` | `false` | Clicks on external links |
 | `trackInteractions` | `boolean` | `false` | Button clicks and form submissions |
@@ -158,6 +158,10 @@ All options are passed under the `databuddy` key in `nuxt.config.ts`:
 | `samplingRate` | `number` | `1.0` | Event sampling rate (0.0–1.0) |
 | `flags` | `FlagsConfig` | — | Feature flag configuration |
 
+<Callout type="info" title="Renamed from trackPerformance">
+  `trackPerformance` still works as a deprecated compatibility alias. Rename it to `trackWebVitals`; if both are set, `trackWebVitals` takes precedence.
+</Callout>
+
 ## Privacy
 
 <CodeBlock language="ts" filename="nuxt.config.ts">

apps/docs/lib/public-copy-contract.test.ts

@@ -23,6 +23,40 @@ describe("public copy contracts", () => {
 		expect(publicDocs).not.toContain("trackSessions=");
 	});
 
+	it("lists every performance metric collected by trackWebVitals", async () => {
+		const configuration = await readFile(
+			join(
+				import.meta.dir,
+				"..",
+				"content",
+				"docs",
+				"sdk",
+				"configuration.mdx"
+			),
+			"utf8"
+		);
+		const vitalsPlugin = await readFile(
+			join(
+				import.meta.dir,
+				"..",
+				"..",
+				"..",
+				"packages",
+				"tracker",
+				"src",
+				"plugins",
+				"vitals.ts"
+			),
+			"utf8"
+		);
+		const description = "FCP, LCP, INP, CLS, TTFB, and FPS";
+
+		expect(configuration.split(description)).toHaveLength(3);
+		for (const metric of ["FCP", "LCP", "INP", "CLS", "TTFB", "FPS"]) {
+			expect(vitalsPlugin).toContain(`on${metric}(handleMetric)`);
+		}
+	});
+
 	it("keeps the tracker-size claim aligned with the checked-in bundle", async () => {
 		const bundle = await readFile(
 			join(

apps/docs/package.json

@@ -91,6 +91,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.1",
+    "@databuddy/tracker": "workspace:*",
     "@tailwindcss/postcss": "^4.2.2",
     "@types/d3": "^7.4.3",
     "@types/d3-geo": "^3.1.0",

bun.lock

@@ -75,6 +75,9 @@ export function sanitizePageUrl(value: string): string {
 	}
 	try {
 		const url = new URL(value);
+		if (!(url.protocol === "http:" || url.protocol === "https:")) {
+			return "";
+		}
 		return `${url.origin}${url.pathname}`;
 	} catch {
 		return "";

packages/tracker/src/core/utils.ts

@@ -123,6 +123,15 @@ describe("privacy-safe page context", () => {
 		).toBe("https://referrer.example/path");
 	});
 
+	test("only accepts HTTP page and referrer URLs", () => {
+		expect(sanitizePageUrl("http://example.com/path?secret=value")).toBe(
+			"http://example.com/path"
+		);
+		expect(sanitizePageUrl("javascript:alert(1)")).toBe("");
+		expect(sanitizePageUrl("data:text/plain,private")).toBe("");
+		expect(sanitizePageUrl("file:///tmp/private.txt")).toBe("");
+	});
+
 	test("honors Global Privacy Control", () => {
 		Object.defineProperty(globalThis, "window", {
 			configurable: true,