feat: strip analytics from webflow wepbage during rewrite for dev

[drankou]

part of DASH-159

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web	Ready	Preview, Comment	Jul 9, 2026 8:39am

[linear-code]

DASH-159

[claude]

LGTM — small, env-gated change with solid test coverage.

Extended reasoning...

Overview

This PR adds a stripAnalytics option to rewriteContentPagesHtml in src/lib/utils/rewrites.ts that removes third-party analytics tags (GTM, GA4, PostHog, LinkedIn Insight) from proxied Webflow HTML. The route handler at src/app/(rewrites)/[[...slug]]/route.ts enables it only when VERCEL_ENV !== 'production', so preview/dev traffic no longer pollutes production analytics. Includes a new unit test file covering positive, negative, and default-off behavior.

Security risks

None. The change removes outbound tracking scripts from proxied HTML in non-production environments — the operation strictly reduces attack surface (fewer third-party scripts loaded). It does not touch auth, crypto, permissions, or user data handling.

Level of scrutiny

Low. The change is small (~35 lines of logic + ~60 lines of tests), self-contained in one utility function, and gated by an environment variable so production behavior is unchanged. The option defaults to falsy, preserving existing call sites' behavior. The matcher list is conservative and clearly documented.

Other factors

The bug hunting system found no issues. Tests cover the three main paths (strip enabled removes analytics, non-analytics content preserved, strip disabled leaves everything intact). Cheerio-based approach is consistent with the existing SEO/href rewrite helpers in the same file.