Console logs reveal Meta Pixel IDs (e.g., 1847743629127484, 854612657635027), which are tracking identifiers used by third parties. Printing these IDs in the client console can enable cross-site tracking or profiling by unintended actors and increases the risk of data leakage.

While debugging, developers may log identifiers; however, exposing third-party tracking IDs in production console logs constitutes a privacy risk and should be avoided regardless of debugging needs.

Remove or redact Meta Pixel IDs from all console logs. Gate analytics-related logs behind a development-only flag or environment check. Implement a redaction function to mask IDs (e.g., PixelID_REDACTED) and ensure logs do not reveal tracking identifiers. Consider moving such logging to server-side telemetry with proper data governance.

Preventing exposure of third-party tracking identifiers in client-side logs reduces the risk of cross-site tracking, preserves user privacy, and improves compliance with privacy regulations.

Publicly accessible image URL contains a personal name within the path (Uploaded Data/Akash/...). This exposes Personally Identifiable Information (PII) in network requests and server logs, increasing risk of user identification and social engineering. Even if the name is a filename, it is still associated with a person and can be exposed via referer headers, server logs, or analytics.

If 'Akash' is an internal alias or the image is publicly uploaded without any sensitive PII, some teams may consider it non-sensitive. However, filenames containing real names are generally not acceptable as they can reveal personal information.

Do not expose user or staff real names in URLs. Store files with non-identifiable IDs (UUIDs) and maintain a server-side mapping. Generate CDN/asset URLs using opaque IDs or hash of content, not the original filename. Consider removing spaces and personal names from path. Sanitize and consolidate uploaded filenames.

Reduces exposure of PII in URLs, server logs, analytics, and Referer headers. Improves privacy by minimizing data in public asset paths.

The site loads Cloudflare's beacon.js (static.cloudflareinsights.com/beacon.min.js), a third-party analytics/telemetry endpoint. This enables user activity tracking to a third party and may occur without explicit user consent, violating privacy expectations and potentially regulatory requirements.

Beacons are common for performance and security telemetry; however, without consent or explicit disclosure, this constitutes unconsented tracking. If consent mechanism exists elsewhere, this could be mitigated, but based on provided data, no consent prompt is visible.

Move third-party tracking behind a consent wall or disable until user opt-in. If needed, ensure IP anonymization and data minimization in requests to Cloudflare. Alternatively replace with first-party analytics or provide an opt-out.

Reduces cross-site tracking and data sharing with third parties, aligns with privacy regulations (GDPR/CCPA), and improves user trust.