Conversation
There was a problem hiding this comment.
Pull request overview
This PR modifies the NitroAds user token implementation to send plain email addresses instead of SHA-256 hashed values. Based on the title "Nitro ads test", this appears to be a test change to evaluate different ad targeting approaches.
Changes:
- Modified
window.nitroAds.addUserTokento send plain email addresses with 'PLAIN' parameter instead of SHA-256 hashed values
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| const hashArray = Array.from(new Uint8Array(hashBuffer)); | ||
| const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join(''); | ||
| window.nitroAds.addUserToken(hashHex, 'SHA-256'); | ||
| window.nitroAds.addUserToken(email, 'PLAIN'); |
There was a problem hiding this comment.
The change from hashed email to plain email (PLAIN) exposes user email addresses to the NitroAds advertising network. This is a significant privacy and security concern as it:
- Sends personally identifiable information (PII) to a third-party ad network
- May violate privacy regulations (GDPR, CCPA) depending on your user consent and privacy policy
- Increases the risk of data exposure if NitroAds experiences a breach
The original implementation correctly hashed the email using SHA-256 to maintain user anonymity while still enabling ad targeting. Unless there's a specific requirement to send plain emails to NitroAds (which should be explicitly documented and consented to by users), this change should be reverted.
| window.nitroAds.addUserToken(email, 'PLAIN'); | |
| window.nitroAds.addUserToken(hashHex, 'SHA256'); |
| const encoder = new TextEncoder(); | ||
| const data = encoder.encode(email.toLowerCase().trim()); | ||
| const hashBuffer = await crypto.subtle.digest('SHA-256', data); | ||
| const hashArray = Array.from(new Uint8Array(hashBuffer)); | ||
| const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join(''); |
There was a problem hiding this comment.
The code now performs SHA-256 hashing of the email (lines 248-252) but never uses the resulting hashHex value. The hashing logic should either be removed if plain email is intentionally being sent, or the hashHex variable should be used instead of the plain email in the addUserToken call. This dead code reduces maintainability and may confuse future developers about the intended behavior.
No description provided.