appwrite / console

The Console that makes Appwrite tick from the browser πŸ–₯
https://appwrite.io
BSD 3-Clause "New" or "Revised" License
311 stars 131 forks source link

πŸ› Bug Report: GPDR violation in self-hosted Console by monitoring through Sentry without consent or transparency #1169

Open ttrinidad opened 4 days ago

ttrinidad commented 4 days ago

πŸ‘Ÿ Reproduction steps

Using self-hosted Appwrite Console in production environment we can see see it pings back to Sentry without consent and without clear option to disable it (other than not using ENV.PROD) which a major privacy concern and legally against GPDR and other similar online privacy and data protection legislation.

πŸ‘ Expected behavior

To cease violation of GPDR and similar legislation and treat user private data with "Lawfulness, fairness and transparency", as well as having the common courtesy expected of not leaking private information without consent or at least telling people about it.

πŸ‘Ž Actual Behavior

Attempting to contact Sentry always, because of: https://github.com/appwrite/console/blob/0fdd92b89c4195c294fb88d200f23ea52eb8420d/src/routes/%2Blayout.svelte#L49

🎲 Appwrite version

Version 1.5.x

πŸ’» Operating system

Linux

🧱 Your Environment

Version 1.5.7 Installed using Coolify

πŸ‘€ Have you spent some time to check if this issue has been raised before?

🏒 Have you read the Code of Conduct?

Meldiron commented 2 days ago

Thanks for reporting this πŸ™Œ Regarding GDPR, that could possibly be a problem for Cloud users too. Not a legal expert, but I believe collecting anonymous data is considered GDPR-safe.

With that said, this implementation was meant for usage on Cloud domains only, as an experiment to ensure it provides value. Later we planned to support it on self-hosting if we see good insights - with ability to customize DSN.

For now, Arman can make a quick PR to avoid Sentry.init() on self-hosted instances.