[saengel]

Integrating analytics

[gitvelocity-reviewer]

📊 Code Quality Score: 4/100

Base 16 (S3 + A1 + I2 + R4 + Q5 + P1) x 0.25 ESF (Micro, 12 effective lines, 2 files) = 4

Category	Score	Factors
🔭 Scope	3/20	Touches two files: index.html gains the gtag script block and e2e/support.ts gains one page.route call. No other subsystem is involved.
🏗️ Architecture	1/20	No module boundary changed. The change adds a third-party script dependency to the HTML head and one more route interceptor in the existing test fixture.
⚙️ Implementation	2/20	index.html defines window.dataLayer, a gtag function, and calls gtag('js', new Date()) and gtag('config', 'G-44RHV2ZWQ1'). e2e/support.ts calls route.abort() for URLs matching `/googletagmanager.com
⚠️ Risk	4/20	Every production page view now loads a script from googletagmanager.com and reports to one GA4 property. The snippet has no consent gate, and non-production hosts would report to the same property. Reverting means deleting the snippet block.
✅ Quality	5/15	No new test is added. The new route in e2e/support.ts keeps the existing e2e suite offline and carries a comment naming index.html as the reason. Nothing verifies that the snippet loads or that the abort route matches.
🔒 Perf / Security	1/5	The script tag uses async, so it does not block parsing. The e2e abort route stops test traffic from reaching the real property. No consent mode or CSP changes accompany it.

Was this score accurate? 👍 Yes · 👎 No

How this was scored →

_{Scored by GitVelocity · How are scores calculated?}

[Copilot]

🟡 Changes recommended

The GA4 integration bypasses analytics opt-outs and privacy signals, exposes search queries through automatic page views, and creates cookies contrary to the documented privacy promise.

4 open issues

• Load GA4 only through privacy-gated analytics initialization · New
• Reconcile GA4 cookies with the no-cookie analytics contract · New
• Sanitize GA4 page views to exclude URL queries and hashes · New
• Prevent automatic GA4 page views for excluded chart routes · New

What changed in this PR

Adds Google Analytics 4 visitor tracking alongside the app’s existing analytics integration, with request blocking in end-to-end tests.

Changes:

• Loads gtag.js and initializes the GA4 property in the HTML entry point.
• Blocks Google tag and analytics requests in the shared test fixture to prevent test traffic from reaching the property.

File	Description
index.html	Adds the GA4 script and initialization.
e2e/​support.ts	Blocks GA4 network requests during end-to-end tests.

_{Review effort: Balanced}