DATADOG HAS A SECURITY FOOTGUN

Summary from the TLDR Web Dev newsletter

Datadog's Real User Monitoring (RUM) package has an API that can lead to sensitive user data being accidentally sent to unintended domains. The "site" parameter can be confusing - developers can easily mistake it for their website domain. Instead of defaulting to Datadog's data intake domains, the RUM package constructs a new domain based on the provided "site" value, which could potentially send data to a domain the developer doesn't control. This happened to a company called Corporate Clash, where a misconfiguration led to user data being sent to an unauthorized third-party domain.