Search results

CORS misconfiguration + SameSite=None cookies enable cross-origin CSRF

Status: Open.

#1038 In rybbit-io/rybbit;

· geo-chen opened on Jul 3, 2026

Ingestion endpoints have no protection

Status: Open.

#1036 In rybbit-io/rybbit;

· pgrond opened on Jun 29, 2026

Add CSP headers for better security

Status: Open.

#1035 In rybbit-io/rybbit;

· pgrond opened on Jun 29, 2026

Cloudflare Workers proxy on Rybbit Cloud geolocates visitors as United States

Status: Open.

#1034 In rybbit-io/rybbit;

· mavam opened on Jun 29, 2026

[Feature] Autocomplete attribute for password input fields

Status: Open.

#1033 In rybbit-io/rybbit;

· timint opened on Jun 28, 2026

Umami export/import format

Status: Open.

#1032 In rybbit-io/rybbit;

· Choque opened on Jun 26, 2026

Autocapture events (input_change, form_submit, etc.) cannot be used as goal/funnel targets — stored in "type", not "event_name"

Status: Open.

#1031 In rybbit-io/rybbit;

· micudaj opened on Jun 25, 2026

Clickhouse and package version upgrade

Status: Open.

#1025 In rybbit-io/rybbit;

· baek-sang opened on Jun 20, 2026

Bug: Fresh installation fails with ClickHouse UNKNOWN_IDENTIFIER errors and broken sessions functionality

Status: Open.

#1024 In rybbit-io/rybbit;

· DamirLut opened on Jun 15, 2026

Show each funnel's conversion rate in the collapsed list view

Status: Open.

#1013 In rybbit-io/rybbit;

· Metis77 opened on May 31, 2026

Tags seems not supported in self hosted client script nor node js package

Status: Open.

#999 In rybbit-io/rybbit;

· HerrDerb opened on May 19, 2026

Embed widget should support the same public site id as the tracking script (hex sites.id)

Status: Open.

#994 In rybbit-io/rybbit;

· pedrocasado opened on May 14, 2026