Repository navigation
fix(desktop): capture inbox feedback notes - #103900
Conversation
Generated-By: PostHog Desktop Task-Id: 9052dba2-fd18-4272-b44c-7da9eddb32cf
|
😎 Merged successfully - details. |
dmarticus
added
the
skip-inkeep-docs
PostHog
|
React Doctor found no issues in the changed files. 🎉 Reviewed by React Doctor for commit |
🤖 CI report✅ Trunk lane — non-backend lane (
|
 The PR appears safe to merge. Reviews (1) · Last reviewed commit: "fix(desktop): capture inbox feedback not..." |
|
Understand this PR’s impact Explore downstream dependencies and potential security impact with Blast Radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: PostHog/posthog/.coderabbit.yaml Review profile: QUIET Plan: Enterprise Run ID: 📒 Files selected for processing (8)
Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review. 📝 WalkthroughWalkthroughDesktop inbox analytics now records feedback note text instead of its length. Bulk dismiss events can include a non-empty dismissal note, while snooze events omit dismissal fields. Inbox analytics types add refund actions, refund reasons, and refund notes. Successful refunds now emit a refund analytics event with the reason and optional note. Tests cover feedback, dismissal, snooze, and refund payloads. Priority: ➖ Normal Severity of issue fixed: Medium 🚥 Pre-merge checks | ✅ 1✅ Passed checks (1 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
HostHog preview —
|
![parameterai[bot]](https://avatars.githubusercontent.com/in/2665233?s=60&v=4){kind=small}
| ...base, | ||
| sentiment, | ||
| note_length: text.length, | ||
| note: text, |
There was a problem hiding this comment.
This change replaces a privacy-preserving note_length: number field with the raw note: text content in the INBOX_REPORT_FEEDBACK_NOTE event, and adds dismissal_note/refund_note free-text fields to INBOX_REPORT_ACTION. These notes are free-form text typed by desktop reviewers about customer reports (support/PR review context) and up to 4000 characters (FEEDBACK_NOTE_MAX_LENGTH), so they can contain customer PII, account details, or other sensitive business data. The removed comment at products/desktop/packages/ui/src/features/inbox/hooks/useReportFeedbackTracker.ts previously stated explicitly: "analytics captures only the note length, never its contents" — that safeguard is now gone with no redaction, scrubbing, or consent gate before the text is forwarded to the analytics pipeline (track(...) → PostHog capture, which may be replicated to data warehouses/third parties and viewed by a much broader audience than the original reviewer note).
Concretely: products/desktop/packages/ui/src/features/inbox/hooks/useReportFeedbackTracker.ts:46-50 sends note: text verbatim; products/desktop/packages/ui/src/features/inbox/hooks/useRefundReport.ts:34-37 sends refund_note: input.note; products/desktop/packages/core/src/inbox/engagement.ts:105-107 propagates dismissal_note. None of these paths apply any sanitization/redaction before the text leaves the client into the analytics event stream. Recommend either reverting to length/hash-only capture, or explicitly classifying these fields as free-text/PII in the analytics pipeline and gating their storage/visibility (e.g., excluding from broadly-replicated warehouses, redacting known PII patterns) before shipping this contract change.
Severity: medium | Confidence: 55% | React with 👍 if useful or 👎 if not
There was a problem hiding this comment.
this was by design
There was a problem hiding this comment.
Understood — since capturing the full note text is the intentional purpose of this PR (per the description: "Desktop feedback events now capture the full reviewer note"), I'll treat this as accepted/by design rather than a defect to fix in this PR. I'd still flag for the team, outside of this review, that these notes are free text potentially containing customer PII or sensitive business details, so it's worth confirming the analytics pipeline's data handling/retention policy accounts for that (e.g., PII scrubbing rules, warehouse replication scope) rather than treating it as opaque length-only telemetry going forward. No further action needed from me here.
![stamphog[bot]](https://avatars.githubusercontent.com/in/3000332?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approved.
Changes analytics event payloads to include note text instead of just length — a disclosed, intentional change to the event contract, and the author is on the owning team with strong recent familiarity in these exact files, which satisfies the independent-assurance bar for that risky-adjacent surface. Tests were updated/added to cover the new fields.
- Author wrote 89% of the modified lines and has 29 merged PRs in these paths (familiarity STRONG).
- 👍 on the PR from greptile-apps[bot].
- 8 of the 8 changed files are governed by
products/desktop/AGENT_APPROVALS.md.
Gate mechanics and policy version
| Gate | Result | |
|---|---|---|
| prerequisites | ✓ | all clear |
| deny-list | ✓ | no deny categories matched |
| size | ✓ | 33L, 5F substantive, 130L/8F incl. docs/generated/snapshots — within ceiling |
| tier | ✓ | T1-agent / T1c-medium (130L, 8F, single-area, fix) |
| stamphog 2.0.0 | .stamphog/policy.yml @ 6d2658c · reviewed head 6d2658c |
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
| ...base, | ||
| sentiment, | ||
| note_length: text.length, | ||
| note: text, |
There was a problem hiding this comment.
Medium: Sensitive note contents enter telemetry
A user can now send arbitrary sensitive text into the shared analytics project by entering it in a feedback note. The same raw-text sink is added for dismissal notes in useInboxBulkActions.ts and refund notes in useRefundReport.ts; retain only non-content metadata such as note presence or length, or send the text through a dedicated access-controlled feedback channel with appropriate retention and disclosure.
PR overviewThis PR updates the desktop inbox feedback flow to capture notes associated with feedback, dismissals, and refund reports. One security issue remains open: raw user-entered note contents are sent to the shared analytics system, potentially exposing sensitive information through telemetry. No issues have yet been addressed, so note collection should be limited to non-content metadata or routed through an appropriately controlled feedback channel. Open issues (1)
Fixed/addressed: 0 · PR risk: 6/10 |
Problem
Desktop reviewers can submit qualitative report feedback, but some analytics events omit the text and make cross-client analysis incomplete.
Closes #103632
Changes
How did you test this code?
pnpm --dir products/desktop typecheckpnpm --dir products/desktop lint./bin/hogli ci:preflight --fix👉 Stay up-to-date with PostHog coding conventions for a smoother review.
Automatic notifications
Docs update
No public docs update is needed because this change only aligns internal analytics payloads.
🤖 Agent context
Autonomy: Human-driven (agent-assisted)
Agent: PostHog Slack app, GPT-5
/posthog-desktop,/writing-tests,/writing-code-comments,/running-ci-preflight,/reviewing-with-coderabbit, and/writing-pr-descriptions.Created with PostHog from a Slack thread