Name: CookieBeam
Availability: InStock

Security

API route hardening: All critical API endpoints (SCIM webhook, revalidation, Stripe webhook, consent logging) now validate input with Zod schemas before processing. Payload size limits and structured error responses prevent abuse.
Open redirect fix: The redirect validation now checks the raw URL pathname against the allowlist, preventing encoded-path traversal attacks.
Metrics API key untracked: Monitoring credentials removed from Git history.

Legal and Compliance

Data Processing Agreement (DPA): Published a vendor-favorable DPA within the Art. 28 GDPR floor, plus a sub-processor list. Available at /dpa.
Terms of Service: Revised ToS draft prepared for Italian legal review.
ICU message syntax fix: 10 i18n keys across Auth, Common, and Settings had incorrect message format syntax. Fixed to ensure all 11 locales render correctly.

Intl formatter caching: Pricing pages now cache Intl.NumberFormat instances instead of creating new ones on every render. Reduces garbage collection pressure on pages with multiple formatted numbers.
i18n gap closure: Dashboard views that had hardcoded English strings are now properly internationalized.

Dialog close button: Added explicit ARIA label to the dialog close button component used across the dashboard.

Error messages sanitized: 19 places across the dashboard were rendering raw tRPC error messages (potentially exposing SQL or Stripe API internals). All replaced with user-friendly generic messages.
Console output cleaned: Removed console.error calls from production client code (onboarding, email verification) that leaked error objects to browser DevTools.
Consent test coverage: Added tests for the 64KB payload size limit and timestamp clamping in the consent logging route.

Published 310+ guides and articles covering cookie consent for every major framework, platform, and jurisdiction. New this month: