Search results

Session replay recorder requires style-src 'unsafe-inline' — use CSSOM instead of string-based style writes

Status: Open.

#1085 In rybbit-io/rybbit;

· Metis77 opened on Jul 20, 2026

IP exclusion not working + same user counted as multiple sessions (cloud)

Status: Open.

#1082 In rybbit-io/rybbit;

· tgoarant opened on Jul 19, 2026

Exclude localhost hostname from tracking

Status: Open.

#1081 In rybbit-io/rybbit;

· soumendrak opened on Jul 19, 2026

v2.7.0 silently breaks visitor identification behind chained reverse proxies (X-Real-IP now takes precedence over X-Forwarded-For) — not in release notes

Status: Open.

#1041 In rybbit-io/rybbit;

· trftky opened on Jul 9, 2026

CORS misconfiguration + SameSite=None cookies enable cross-origin CSRF

Status: Open.

#1038 In rybbit-io/rybbit;

· geo-chen opened on Jul 3, 2026

Ingestion endpoints have no protection

Status: Open.

#1036 In rybbit-io/rybbit;

· pgrond opened on Jun 29, 2026

Add CSP headers for better security

Status: Open.

#1035 In rybbit-io/rybbit;

· pgrond opened on Jun 29, 2026

Cloudflare Workers proxy on Rybbit Cloud geolocates visitors as United States

Status: Open.

#1034 In rybbit-io/rybbit;

· mavam opened on Jun 29, 2026

[Feature] Autocomplete attribute for password input fields

Status: Open.

#1033 In rybbit-io/rybbit;

· timint opened on Jun 28, 2026

Umami export/import format

Status: Open.

#1032 In rybbit-io/rybbit;

· Choque opened on Jun 26, 2026

Autocapture events (input_change, form_submit, etc.) cannot be used as goal/funnel targets — stored in "type", not "event_name"

Status: Open.

#1031 In rybbit-io/rybbit;

· micudaj opened on Jun 25, 2026

Clickhouse and package version upgrade

Status: Open.

#1025 In rybbit-io/rybbit;

· baek-sang opened on Jun 20, 2026