Audit ClickTrail
Remain read-only. Do not install packages, edit files, or call live endpoints.
- Read project instructions, tracking docs, manifests, and the integration entry points.
- Read
../../references/clicktrail-safety-contract.md. - Trace startup, capture, persistence, delivery, withdrawal, stop, and retry paths. Inspect every caller of shared constructors or serializers.
- Check that trusted host configuration wins over caller-controlled attribution.
- Check server destinations for public credential-free HTTPS enforcement.
- Check payloads against a concrete allowlist. Treat arbitrary objects and raw passthrough as findings even when current callers appear safe.
- Check tests for observable consent-denial, withdrawal-erasure, redaction, SSRF, delivery-failure, and tenant-collision behavior.
Report findings as Critical, Important, or Minor. Each finding must name the file, behavior, impact, and smallest safe correction. End with verified passes and unresolved evidence. Do not turn missing evidence into a pass.