SECURITY FIX REQUIRED: A JWT authentication token has been found embedded in a URL query parameter sent to click.prod.mplat-ppcprotect.com, visible in browser console logs. This creates multiple security vulnerabilities: tokens in URLs are logged by browsers, proxies, and servers, enabling session hijacking and token replay attacks. Immediately refactor the authentication mechanism to: 1) Remove the 'token' parameter from the URL. 2) Transmit authentication credentials via HTTP Authorization header with Bearer scheme instead. 3) If using POST requests, move token to request body instead of query parameters. 4) Implement token expiry and rotation policies. 5) Add security headers like Strict-Transport-Security and X-Content-Type-Options. Verify the fix by confirming tokens no longer appear in network request URLs in browser DevTools.

CRITICAL SECURITY VULNERABILITY: Multiple JWT tokens and session identifiers are being transmitted in URL parameters to click.prod.mplat-ppcprotect.com, visible in browser console. The 'data' parameter contains base64-encoded JSON with plaintext authentication tokens that are logged, cached, and intercepted. This is a critical vulnerability enabling account takeover. IMMEDIATE ACTION: 1) Cease all token transmission via URL parameters. 2) Move tokens to HTTP Authorization header using Bearer scheme. 3) Use secure httpOnly, Secure, SameSite cookies for session state instead of URL parameters. 4) Implement token expiration (15-60 minute lifetime). 5) Implement refresh token rotation on new access token issuance. 6) Audit all outbound requests to ensure no tokens appear in URLs or visible logs. 7) Implement Content Security Policy in enforce mode (not report-only) to block unwhitelisted domains. Test by verifying no tokens appear in network tab of DevTools and that all authentication uses Authorization headers.

You are fixing a critical privacy issue where a user data structure (including email, name, gender, account_type) is being transmitted to a third-party tracking service via image beacon URLs. The issue: Even though current values are empty, the infrastructure exists to send PII via nova.collect.igodigital.com in plaintext URL-encoded JSON. This violates GDPR and CCPA. Fix this by: 1) Remove the user_info object entirely from tracking pixel payloads sent to igodigital.com. 2) Implement a data minimization layer that strips all PII fields before constructing analytics payloads. 3) Migrate from image beacon tracking to server-side event tracking that never exposes user data in client-side logs. 4) Add validation logic that prevents any email, name, phone, or personally identifiable field from being included in third-party tracking URLs. 5) Redact all user_info structures from console logs before they reach the browser console. Code should check for email patterns, name fields, and account identifiers and remove them before any tracking call is made.