Is PostHog Safe?
Security analysis for apps built with PostHog. Open-source product analytics with session recording, feature flags, and A/B testing.
Is PostHog safe? The short answer
PostHog itself is a reputable product analytics platform, and its JavaScript snippet is designed to run in the browser. Having PostHog in your frontend is not a vulnerability in itself: the project key it uses can only send events, not read your data.
The real risk with PostHog is privacy rather than intrusion. Analytics and session replay can quietly collect much more than you intended: emails, tokens in URLs, form contents, health or payment details visible on screen. And if a personal API key ends up in the frontend, anyone can query everything PostHog has collected. Securing PostHog means choosing which keys go where and what data you capture.
Scan your PostHog app now
Enter your URL and get a full security report in 30 seconds. Free, no signup required.
Scan Your PostHog AppPostHog misconfigurations we see in AI-built apps
A personal API key in the frontend
The project API key (phc_…) is public by design: it is write-only and meant for ingestion. Personal API keys (phx_…) can read your analytics data, persons and recordings through the API. They belong only on a server or in a CI secret, with the narrowest scopes possible.
Personal data sent in events
AI-generated code often calls identify with full profiles, or attaches emails, names and addresses to every event. Autocapture and $current_url can also record password-reset or magic-link tokens present in URLs. Send stable IDs instead of personal details, and keep secrets out of URLs.
Session replays that show sensitive screens
Session replay masks input fields by default, but text displayed on the page (account details, messages, medical or financial data) can be recorded unless you mask it. Turning masking off to debug and forgetting to turn it back on is a classic mistake.
Feature flags used as access control
Flags evaluated in the browser can be read and changed by the user. Hiding a premium or admin feature behind a client-side flag is not a security check: enforce permissions on the server.
PostHog security checklist
- Search your bundle for
phx_; if a personal key leaked, revoke it in your PostHog settings and create a scoped replacement. - Send user IDs, not emails or names, and review which properties autocapture collects.
- Keep input masking on, mask sensitive text with a selector, and add the
ph-no-captureclass to elements that must never be recorded. - Strip tokens from URLs before they reach analytics, or avoid putting them in URLs at all.
- Pick the PostHog region (US or EU) that matches your privacy obligations and document it in your privacy policy.
posthog.init(process.env.NEXT_PUBLIC_POSTHOG_KEY!, { // phc_ project key: public by design
api_host: "https://eu.i.posthog.com",
session_recording: {
maskAllInputs: true, // keep form inputs masked
maskTextSelector: "[data-private]", // mask sensitive text too
},
});
// Never ship a phx_ personal API key to the browser.Common Security Issues in PostHog Apps
Exposed API Keys
AI coding tools often embed API keys directly in frontend JavaScript. If you're using PostHog, check that secret keys aren't in your client-side bundle.
Missing Security Headers
Headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options protect against XSS, clickjacking, and downgrade attacks.
Vulnerable Dependencies
Outdated npm packages with known CVEs are common in AI-generated code. Regular audits catch these before attackers do.
Authentication Weaknesses
Open registration endpoints, missing rate limiting, and exposed auth tokens are frequent issues in vibe-coded apps.
What ScanVibe Checks
Frequently Asked Questions
Is PostHog safe to use?
PostHog itself is a reputable platform, but apps built with PostHog often have security misconfigurations — exposed API keys, missing security headers, and vulnerable dependencies. ScanVibe scans your app to find these issues.
What security issues do PostHog apps commonly have?
The most common issues we find in PostHog apps are: exposed API keys in frontend JavaScript, missing security headers (CSP, HSTS), outdated dependencies with known vulnerabilities, and misconfigured authentication endpoints.
How do I check if my PostHog app is secure?
Enter your app's URL in ScanVibe's scanner. We'll check for exposed secrets, security headers, vulnerable libraries, exposed files, and platform-specific misconfigurations — all in about 30 seconds.
Does ScanVibe scan PostHog specifically?
Yes. ScanVibe detects PostHog in your stack and runs platform-specific security checks in addition to our standard 8-category analysis.
Is the PostHog project API key a secret?
No. The project API key (starting with phc_) is meant to be public: it ships in your frontend and can only send events. Personal API keys (starting with phx_) are secrets because they can read your data through the PostHog API; keep them on the server and revoke any that leaked.
Does PostHog session replay record passwords and personal data?
Input fields are masked by default, so typed passwords are not recorded unless you disable masking. Text displayed on the page is a different story: use text masking selectors or the ph-no-capture class on sensitive areas, and avoid sending personal details as event properties.