From 658af281ee3b75503d048c30eee94ee34b2ee7fd Mon Sep 17 00:00:00 2001
From: Brad Anderson <brad@metabase.com>
Date: Thu, 8 Oct 2026 14:21:19 -0400
Subject: [PATCH 1/2] fix security issues flagged in
 https://github.com/metabase/metabase.github.io/pull/6651/checks?check_run_id=113024868999

---
 .github/workflows/test.yml                   |  3 +++
 .github/workflows/update-version-support.yml |  4 ++++
 public/docs/js/anonymous-snowplow.js         | 15 ++++++++++++---
 public/docs/js/marketing-snowplow.js         | 15 ++++++++++++---
 4 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a5da2308d0..0be30796ad 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,9 @@ on:
     branches:
       - "master"
 
+permissions:
+  contents: read
+
 jobs:
   test-build:
     name: Test Docs Build
diff --git a/.github/workflows/update-version-support.yml b/.github/workflows/update-version-support.yml
index 21e493444a..2493478e2f 100644
--- a/.github/workflows/update-version-support.yml
+++ b/.github/workflows/update-version-support.yml
@@ -8,6 +8,10 @@ on:
 
 run-name: Nightly version support update
 
+permissions:
+  contents: read
+  pull-requests: write
+
 env:
   VERSION_INFO_URL: https://static.metabase.com/version-info.json
   DATA_FILE: _data/major_version_support.json
diff --git a/public/docs/js/anonymous-snowplow.js b/public/docs/js/anonymous-snowplow.js
index ea45887106..961acfe16a 100644
--- a/public/docs/js/anonymous-snowplow.js
+++ b/public/docs/js/anonymous-snowplow.js
@@ -39,10 +39,19 @@ if (formattedCustomUrlAnon) {
 }
 
 // custom referrer (only for metabase.com)
+var referrerUrl = null;
+try {
+  referrerUrl = document.referrer ? new URL(document.referrer) : null;
+} catch (e) {
+  // Ignore invalid referrer URLs
+  referrerUrl = null;
+}
+
 if (
-  document.referrer &&
-  (document.referrer.indexOf("https://www.metabase.com") > -1 ||
-    document.referrer.indexOf("https://metabase.com") > -1)
+  referrerUrl &&
+  referrerUrl.protocol === "https:" &&
+  (referrerUrl.hostname === "www.metabase.com" ||
+    referrerUrl.hostname === "metabase.com")
 ) {
   var formattedReferrerUrlAnon = window.redirectTo(document.referrer);
   if (formattedReferrerUrlAnon) {
diff --git a/public/docs/js/marketing-snowplow.js b/public/docs/js/marketing-snowplow.js
index 80b85f9937..0637a1542e 100644
--- a/public/docs/js/marketing-snowplow.js
+++ b/public/docs/js/marketing-snowplow.js
@@ -42,10 +42,19 @@ if (formattedCustomUrl) {
 }
 
 // custom referrer (only for metabase.com)
+var referrerUrl = null;
+try {
+  referrerUrl = document.referrer ? new URL(document.referrer) : null;
+} catch (e) {
+  // Ignore invalid referrer URLs
+  referrerUrl = null;
+}
+
 if (
-  document.referrer &&
-  (document.referrer.indexOf("https://www.metabase.com") > -1 ||
-    document.referrer.indexOf("https://metabase.com") > -1)
+  referrerUrl &&
+  referrerUrl.protocol === "https:" &&
+  (referrerUrl.hostname === "www.metabase.com" ||
+    referrerUrl.hostname === "metabase.com")
 ) {
   var formattedReferrerUrl = window.redirectTo(document.referrer);
   if (formattedReferrerUrl) {

From 231822c4644113dd763db04814c5546b0ede0166 Mon Sep 17 00:00:00 2001
From: Brad Anderson <brad@metabase.com>
Date: Fri, 9 Oct 2026 09:21:25 -0400
Subject: [PATCH 2/2] pr feedback: remove unnecessary reassignment + rename
 anon variable for clarity and prevent collision

---
 public/docs/js/anonymous-snowplow.js | 13 ++++++-------
 public/docs/js/marketing-snowplow.js |  1 -
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/public/docs/js/anonymous-snowplow.js b/public/docs/js/anonymous-snowplow.js
index 961acfe16a..069245727e 100644
--- a/public/docs/js/anonymous-snowplow.js
+++ b/public/docs/js/anonymous-snowplow.js
@@ -39,19 +39,18 @@ if (formattedCustomUrlAnon) {
 }
 
 // custom referrer (only for metabase.com)
-var referrerUrl = null;
+var referrerUrlAnon = null;
 try {
-  referrerUrl = document.referrer ? new URL(document.referrer) : null;
+  referrerUrlAnon = document.referrer ? new URL(document.referrer) : null;
 } catch (e) {
   // Ignore invalid referrer URLs
-  referrerUrl = null;
 }
 
 if (
-  referrerUrl &&
-  referrerUrl.protocol === "https:" &&
-  (referrerUrl.hostname === "www.metabase.com" ||
-    referrerUrl.hostname === "metabase.com")
+  referrerUrlAnon &&
+  referrerUrlAnon.protocol === "https:" &&
+  (referrerUrlAnon.hostname === "www.metabase.com" ||
+    referrerUrlAnon.hostname === "metabase.com")
 ) {
   var formattedReferrerUrlAnon = window.redirectTo(document.referrer);
   if (formattedReferrerUrlAnon) {
diff --git a/public/docs/js/marketing-snowplow.js b/public/docs/js/marketing-snowplow.js
index 0637a1542e..c700f0c42e 100644
--- a/public/docs/js/marketing-snowplow.js
+++ b/public/docs/js/marketing-snowplow.js
@@ -47,7 +47,6 @@ try {
   referrerUrl = document.referrer ? new URL(document.referrer) : null;
 } catch (e) {
   // Ignore invalid referrer URLs
-  referrerUrl = null;
 }
 
 if (