[P3] Audit: Safe analytics event taxonomy needs documentation

[baixiangcpp]

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: the privacy policy says analytics should be limited to aggregate product signals and should not include tool input, output, secrets, file contents, search query text, or full URLs. A documented safe event taxonomy would make this enforceable.

Affected areas:

• Privacy Policy
• Trust Center
• Analytics instrumentation
• Product metrics

Reproduction steps:

1. Review Privacy Policy and Trust Center analytics sections.
2. Inspect existing analytics events, if any.
3. Check whether safe and unsafe event fields are documented.
4. Check whether new events are reviewed before release.

Expected behavior: every analytics event should have a documented name, purpose, allowed fields, forbidden fields, and privacy review status.

Actual behavior: the analytics policy is described, but a developer-facing event taxonomy is not visible.

Impact: future instrumentation could accidentally collect unsafe fields or create inconsistent metrics.

Proposed fix:

• Add analytics-event documentation.
• List allowed fields such as event name, tool ID, category, action type, and safe result status.
• List forbidden fields such as inputs, outputs, tokens, logs, file contents, search text, and full URLs.
• Add code review checklist for analytics changes.

Acceptance criteria:

• Analytics taxonomy is documented.
• Developers can add safe events without ambiguity.
• Forbidden fields are explicitly listed.
• Privacy policy and implementation stay aligned.

[baixiangcpp]

Closed as completed by the canonical BF audit backlog work. This older non-BF audit issue duplicates work now merged through PRs #209-#219, with the BF issues closed and guard/test coverage in place. The remaining non-duplicate follow-up is #7, which stays open because the upstream Next/PostCSS advisory is not fixed yet.