Security at Yaap

Yaap runs its dashboard, API and event collection on a Cloudflare Worker. Events pass through a queue before being stored in D1 or PostgreSQL.

When you self-host, those resources belong to your own infrastructure accounts. With hosted Yaap, the service operator manages the infrastructure. The privacy notice describes provider and location information.

The dashboard requires authentication. Passwords are hashed, and authentication endpoints apply rate limits. Website reports and settings are scoped to the signed-in user’s permissions.

Owners can invite viewers to specific websites. Public API credentials carry explicit scopes and website access. Treat credentials as secrets and revoke them when they are no longer needed.

A tracking site ID is public: it identifies the destination of an event and does not grant dashboard access. Origin checks and collection filters help control ingestion, but are not a substitute for authentication.

Choose full, anonymous or paused tracking. Configure allowed origins, path exclusions, bot filtering and retention to match the website’s requirements.

Raw browser visitor IDs are hashed with a site-specific input and server secret before queueing. The analytics pipeline keeps coarse device and location categories instead of queueing raw IP addresses or user-agent strings. Hashed identifiers still support linking events and should not be treated as fully anonymous data.

Optional payment integrations verify webhook signatures. Keep webhook secrets and server API credentials on the server.

Self-hosted operators are responsible for HTTPS, infrastructure permissions, secret management, database access, updates and backups. Restrict administrative access and review any third-party integrations you enable.

Keep the installation’s identity secret stable: changing it breaks continuity with existing analytics identifiers. Plan backups and test recovery for the database provider you use. Retention removes history; it is not a backup strategy.

See the operations guide and deployment guide for current instructions.

Send security reports privately. Include the affected version or URL, a description of the issue, its likely impact and the minimum steps needed to reproduce it. Use your own test data and avoid accessing another person’s information.

Send a private security report. Please keep exploit details out of public issues while the report is being investigated.