From 39ed3dd31cd19cf0904f5c8c74cde93f718cba93 Mon Sep 17 00:00:00 2001
From: Beny <benynouba@gmail.com>
Date: Wed, 29 Jul 2026 23:30:56 +0100
Subject: [PATCH] feat(www): proxy Plausible through usewraith.xyz, document
 dashboard access

Closes #79. Serves the analytics script and event beacon from our own
domain via vercel.json rewrites instead of plausible.io directly, so no
analytics request is cross-origin. Also documents that the Plausible
dashboard is internal-only rather than public.
---
 docs/CONTRIBUTING.md  | 46 +++++++++++++++++++++++++++++++++----------
 index.html            | 11 ++++-------
 src/pages/Privacy.tsx | 21 +++++++++++++++++++-
 vercel.json           |  9 ++++++++-
 4 files changed, 68 insertions(+), 19 deletions(-)

diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index 9b454b0..06d40a8 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -20,14 +20,10 @@ cookie-based tracker.
 
 ### How the script is loaded
 
-`index.html` loads the combined Plausible extension script:
+`index.html` loads the Plausible extension script from our own domain:
 
 ```html
-<script
-  defer
-  data-domain="usewraith.xyz"
-  src="https://plausible.io/js/script.scroll.tagged-events.js"
-></script>
+<script defer data-domain="usewraith.xyz" src="/js/script.js"></script>
 <script>
   window.plausible =
     window.plausible ||
@@ -43,10 +39,29 @@ cookie-based tracker.
   custom goal events (see below).
 - The queue shim lets goal events fire before the script fully loads.
 
-**Note on `integrity` attribute:** Plausible does not currently publish SRI
-hashes for their CDN script because they ship frequent minor updates. If your
-CSP requires SRI, proxy the script through your own infrastructure (see
-[Plausible proxy docs](https://plausible.io/docs/proxy/introduction)).
+**Proxied through our own domain.** `/js/script.js` and `/api/event` are never
+requested directly from `plausible.io` in the browser. `vercel.json` rewrites
+both paths to Plausible's servers server-side:
+
+```json
+[
+  {
+    "source": "/js/script.js",
+    "destination": "https://plausible.io/js/script.scroll.tagged-events.js"
+  },
+  { "source": "/api/event", "destination": "https://plausible.io/api/event" }
+]
+```
+
+Plausible's tracker derives its event endpoint from the script's own origin,
+so once the script is served from `usewraith.xyz` it automatically posts
+events to `usewraith.xyz/api/event` too — no separate config needed. This
+means every request a visitor's browser makes stays on our domain: no
+cross-origin request to `plausible.io`, and the script isn't blocked by
+ad/content blockers that filter third-party analytics domains. See
+[Plausible's proxy docs](https://plausible.io/docs/proxy/introduction) for the
+underlying technique. Note this proxies Plausible's *cloud* service — the
+Plausible app itself (Postgres/ClickHouse) is not self-hosted.
 
 ### Custom goals
 
@@ -93,6 +108,17 @@ consent banner is required** under GDPR, PECR, or the ePrivacy Directive. Do
 not add one. See [Plausible's data policy](https://plausible.io/data-policy)
 for the legal basis.
 
+### Dashboard access
+
+The Plausible dashboard for `usewraith.xyz` is **internal-only**, not public.
+Traffic volume, referrers, and goal completion (Careers CTA clicks, demo
+clicks, etc.) are useful to competitors and not something visitors need to
+see. Access is by team invite in Plausible's team settings — ask an existing
+member to add your account if you need it. Revisit this if there's ever a
+concrete reason to publish a subset of metrics (e.g. an open-source-style
+transparency page); that would be a separate, deliberate decision, not a
+config flip.
+
 ---
 
 ## Development setup
diff --git a/index.html b/index.html
index e50fa3d..d63cd9f 100644
--- a/index.html
+++ b/index.html
@@ -33,16 +33,13 @@
     <!--
       Plausible Analytics — cookieless, GDPR-compliant, no consent banner required.
       • No cookies are set; only aggregate page/event counts are stored.
+      • Script and event requests are proxied through usewraith.xyz (see vercel.json)
+        so nothing crosses to plausible.io from the browser's perspective — no
+        cross-origin requests, and the script survives most content/ad blockers.
       • script.scroll.js extension tracks scroll depth at every percent automatically.
       • script.tagged-events.js lets us fire goals from JS via window.plausible().
-      • Integrity hash pins the exact script bytes served by plausible.io CDN.
-      • Replace the integrity value if you upgrade to a newer Plausible release.
     -->
-    <script
-      defer
-      data-domain="usewraith.xyz"
-      src="https://plausible.io/js/script.scroll.tagged-events.js"
-    ></script>
+    <script defer data-domain="usewraith.xyz" src="/js/script.js"></script>
     <script>
       window.plausible =
         window.plausible ||
diff --git a/src/pages/Privacy.tsx b/src/pages/Privacy.tsx
index 16c8bbd..2012ebf 100644
--- a/src/pages/Privacy.tsx
+++ b/src/pages/Privacy.tsx
@@ -62,7 +62,9 @@ export default function Privacy() {
                 Plausible Analytics
               </a>{' '}
               — an open-source, EU-hosted analytics platform — to understand how visitors interact
-              with this site.
+              with this site. The tracking script and its event requests are proxied through{' '}
+              <code className="text-on-surface">usewraith.xyz</code> itself, so your browser never
+              makes a request to a third-party analytics domain.
             </p>
             <p>
               Plausible collects the following{' '}
@@ -87,6 +89,11 @@ export default function Privacy() {
               <li>No cookies are set — ever.</li>
               <li>No persistent identifiers or device fingerprints.</li>
               <li>No cross-site tracking.</li>
+              <li>
+                No cross-origin requests off this domain — the analytics script and events are
+                proxied through <code className="text-on-surface">usewraith.xyz</code>, not loaded
+                directly from a third-party host.
+              </li>
               <li>No IP addresses stored or logged.</li>
               <li>No personal information (name, email, wallet address, etc.).</li>
             </ul>
@@ -104,6 +111,10 @@ export default function Privacy() {
               </a>{' '}
               for the full breakdown.
             </p>
+            <p>
+              The analytics dashboard itself is internal-only — aggregate traffic and goal data
+              are not published anywhere on this site.
+            </p>
           </Section>
 
           <Section title="Why Plausible?">
@@ -117,6 +128,14 @@ export default function Privacy() {
                 <strong className="text-on-surface">EU-hosted</strong> — data is processed on
                 servers in the EU (Hetzner, Germany/Finland). No data transfer to the US.
               </li>
+              <li>
+                <strong className="text-on-surface">Proxied through our domain</strong> — the
+                script and its event requests are served from{' '}
+                <code className="text-on-surface">usewraith.xyz</code>, not{' '}
+                <code className="text-on-surface">plausible.io</code>, so nothing crosses to a
+                third-party domain from your browser and the script isn&apos;t caught by
+                ad/content blockers that filter known analytics hosts.
+              </li>
               <li>
                 <strong className="text-on-surface">Open source</strong> — the full codebase is
                 auditable at{' '}
diff --git a/vercel.json b/vercel.json
index 88d9d59..9a5d977 100644
--- a/vercel.json
+++ b/vercel.json
@@ -1,3 +1,10 @@
 {
-  "rewrites": [{ "source": "/((?!press-kit/).*)", "destination": "/index.html" }]
+  "rewrites": [
+    {
+      "source": "/js/script.js",
+      "destination": "https://plausible.io/js/script.scroll.tagged-events.js"
+    },
+    { "source": "/api/event", "destination": "https://plausible.io/api/event" },
+    { "source": "/((?!press-kit/).*)", "destination": "/index.html" }
+  ]
 }