Security

Eventvisor datafiles contain no secrets, but they are trusted control input. They can change validation, transforms, sampling, routing, destinations, and effects without deploying the application.

Protect the publishing path#

• Serve datafiles over TLS from infrastructure you control.
• Require review for project changes and restrict publishing credentials.
• Keep generated datafiles public and free of credentials, tokens, and personal data.
• Retain revisions and a rollback path. Choose cache settings that let clients recover quickly.
• If your threat model requires signed configuration, verify integrity in your application before calling setDatafile().

Browser scripts#

The Pixel module can turn remotely configured snippets into DOM content. Script execution is disabled by default. Enable it only in trusted applications:

createPixelModule({
  allowScripts: true,
  nonce: () => window.__cspNonce,
});

Use a restrictive Content Security Policy. The configured nonce replaces any nonce supplied by the datafile snippet. Treat compromise of the datafile origin as a potential application security incident.

Delivery and privacy#

Transport modules receive governed event payloads and selected attributes. Review each transport's endpoint, authentication, retention, regional routing, and privacy controls. Eventvisor does not make a third party destination compliant by itself.

Eventvisor rejects unsafe source and transform paths that could traverse object prototypes. Transformed transport payloads must also remain JSON compatible. Functions, symbols, non-finite numbers, circular values, and other values that cannot be transported safely are rejected with a diagnostic.

HTTP and Beacon queues keep snapshots of accepted payloads, so later application mutations cannot change an event that is waiting for delivery. Queue limits should be finite and chosen for the memory available on the target platform.

Report vulnerabilities privately through GitHub Security Advisories instead of a public issue.