Filter third-party exceptions from PostHog error tracking

[posthog]

Problem

• PostHog error tracking on canadaspends.com ingests every third-party exception as a first-party issue, so real regressions have to be spotted against a wall of noise nobody can action.
• posthog.init() in src/app/[lang]/providers.tsx had no before_send hook, so anything a browser extension or injected script throws inside our pages lands in our issue list.
• The trigger was TypeError: window.scanPdf is not a function on /en/first-nations/ISC_8/2022 — a page that renders a government PDF in an iframe. The event has no stack frames, no source, handled: false: the classic shape of a PDF-scanning extension injecting a window.scanPdf global. scanPdf appears nowhere in our bundle.
• That one exception is negligible (1 occurrence / 1 user / 1 session in 90 days). The cost is the shared noise stream the same missing filter lets through — beTracker, Cloudflare Zaraz fetch failures, and runtime.sendMessage extension errors dominate the backlog.

Changes

• Add a before_send hook that drops $exception events with no first-party stack frames — i.e. no frame marked in_app. Exceptions with no frames at all (cross-origin Script error.) can't be attributed to us and are treated as third-party.
• Add a small denylist for injected globals already seen: scanPdf, beTracker, runtime.sendMessage, zaraz.
• Non-$exception events pass through untouched. No user-facing behavior change.

Risk

• A first-party error captured with no stack (e.g. a manual captureException without a stacktrace) would be dropped. The codebase has no such manual captures today, and normal thrown errors carry in-app frames, so this is low-risk and matches the intent of trusting only attributable errors.

Verification

• tsc --noEmit, next lint --file, and prettier --check all pass on the changed file (remaining repo-wide tsc errors are pre-existing and unrelated — MDX component typing and missing vitest types in test files).

Agent context

• Checked all open PRs and the file's history: none touch providers.tsx or exception filtering (PR Add Supabase Auth with OAuth and PostHog identification #269 mentions PostHog but only for auth/identification). No competing work in flight.
• This report was cloned against buildcanada/atip (LICENSE-only); the fix belongs in this repo. Suppressing/resolving the existing noise issues in the PostHog error-tracking backlog still needs to be done in the PostHog UI once this ships.

---

Created with PostHog Desktop from this inbox report.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	canadaspends	5589240	Aug 07 2026, 05:41 PM

[build-canada-deploy-bot]

🚨 Preview Deployment Blocked - Security Protection

Your pull request was blocked from triggering preview deployments

Why was this blocked?

• User: posthog[bot]
• Repository: CanadaSpends
• Permission Level: none
• Required Level: write, maintain, or admin

How to resolve this:

Option 1: Get Collaborator Access (Recommended)
Ask a repository maintainer to invite you as a collaborator with write permissions or higher.

Option 2: Request Permission Override
Ask a repository administrator to disable security validation for this specific application if appropriate.

For Repository Administrators:

To disable this security check (⚠️ not recommended for public repositories):
Enter to preview settings and disable the security check.

---

This security measure protects against malicious code execution in preview deployments. Only trusted collaborators should have the ability to trigger deployments.

🛡️ Learn more about this security feature

This protection prevents unauthorized users from:

• Executing malicious code on the deployment server
• Accessing environment variables and secrets
• Potentially compromising the infrastructure

Preview deployments are powerful but require trust. Only users with repository write access can trigger them.