Search queries and result IDs are sent to external telemetry service

[m75gyqbsrw-boop]

Summary

The client sends full search query state and result identifiers to the external telemetry service (user-telemetry.gutools.co.uk / user-telemetry.code.dev-gutools.co.uk). This includes user-entered search terms, filters, time ranges, and lists of fetched result IDs.

Evidence

Telemetry destination

newswires/client/src/telemetry.ts

export function getTelemetryUrl(stage: string): string {
  const telemetryDomain =
    stage === 'PROD' ? 'gutools.co.uk' : 'code.dev-gutools.co.uk';
  return `https://user-telemetry.${telemetryDomain}`;
}

Full search query is serialized into telemetry tags

newswires/client/src/context/SearchContext.tsx

• NEWSWIRES_FETCHED_RESULTS
• NEWSWIRES_ENTER_SEARCH
• NEWSWIRES_SELECT_ITEM
• NEWSWIRES_TOGGLE_AUTO_UPDATE
• NEWSWIRES_OPEN_TICKER

Each of these includes:

Object.fromEntries(
  Object.entries(currentConfig.query).map(([key, value]) => [
    `search-query_${key}`,
    JSON.stringify(value),
  ]),
)

For fetched results, the client also sends:

resultsIds: data.results.map((wire) => wire.id).join(','),
totalCount: data.totalCount,

Impact

• User-entered editorial search terms and filters are copied to an external telemetry service.
• Result IDs for fetched content are also transmitted, increasing sensitivity.
• Depending on newsroom usage, searches may contain unpublished names, sensitive topics, embargo-related terms, or incident keywords.
• This is a data minimization / unnecessary exposure issue even if the telemetry domain is first-party controlled.

Recommended fix

1. Stop sending raw search query values to telemetry.
   • Send only coarse metadata (e.g. which filters were used, counts, query length, booleans).
2. Do not send raw resultsIds.
   • Use count-based metrics or hashed/aggregated identifiers if absolutely required.
3. Review telemetry events against data minimization principles and document approved fields.
4. Add tests or static checks preventing raw query serialization into telemetry tags.

Suggested priority

Medium — data exposure to an external service; not an immediate exploit primitive, but a real confidentiality/privacy risk.