mirror of
https://github.com/hanzoai/sentinel.git
synced 2026-09-29 22:34:33 +00:00
zeekayandHanzo Dev
a26924402f
BEACON_URL was https://sentry.io/remote/beacon/ and every self-hosted install POSTed to it on a schedule. The payload is not anonymous by default: alongside install id, version and usage counts it carries get_all_package_versions() — the full dependency inventory of the running instance — and, whenever `beacon.anonymous` is off, "admin_email", the address in system.admin-email. So the fork's own operators were reporting their contact details and software inventory to a third party, and the settings page explained the arrangement as though it were still upstream's product. It now posts to api.hanzo.ai/v1/beacon, and the copy on that page says so, which it could not honestly do before. Three more outbound identities went with it. USER_AGENT announced every request this server makes as "sentry/<version> (https://sentry.io)". The Jira and Bitbucket app descriptors named Functional Software as the vendor — that string is what a customer reads in the Atlassian marketplace before installing. And the MS Teams cards sent people to sentry.io/signup for an account they cannot use here. Left alone: comments citing upstream issues, form placeholders, and the OIDC `iss` claim, which is a token-validation input rather than a link. Co-authored-by: Hanzo Dev <[email protected]>