Tracker domain allowlist silently disables analytics for mixed-case hostnames

[SpaleRuby]

Source-confirmed behavior

I reviewed the tracker at exact base
8248ccf3333b9d490712b53a87806abb2e2541cf.

data-domain and data-cross-domain-domains are normalized to lowercase, but
the ordinary data-domains allowlist is only trimmed:

talivia/src/tracker/index.js

Lines 43 to 50 in 8248ccf

	const domains = allowedDomainConfig
	.split(',')
	.map(n => n.trim())
	.filter(Boolean);
	const crossDomains = crossDomainConfig
	.split(',')
	.map(n => n.trim().toLowerCase())
	.filter(Boolean);

That value is later compared directly with location.hostname:

talivia/src/tracker/index.js

Lines 548 to 553 in 8248ccf

	const trackingDisabled = () =>
	disabled ||
	!website ||
	localStorage?.getItem('talivia.disabled') ||
	(allowedDomainConfig && !domains.some(item => hostnameMatches(hostname, item))) ||
	(dnt && hasDoNotTrack());

A source-equivalent reproduction gives:

• browser URL https://WWW.Example.COM/ → hostname www.example.com
• allowlist entry Example.COM → no match
• allowlist entry example.com → match

Since hostnames are case-insensitive, mixed-case configuration currently
silently prevents the tracker from sending analytics. I did not inspect any
customer data or authenticated Talivia Cloud surface.

Optional focused patch — $30 fixed

I can implement and test the smallest tracker-only correction:

• normalize each non-empty data-domains entry after trimming;
• cover mixed-case exact-host and subdomain matches;
• prove a genuinely different hostname remains blocked;
• preserve DNT, explicit disable, cookie-domain, cross-domain, and all other
  tracker behavior;
• run the focused tracker tests, lint, and tracker build.

Acceptance criteria

• data-domains="LOCALHOST" behaves exactly like
  data-domains="localhost".
• Mixed-case parent domains allow their subdomains.
• Unrelated domains remain disabled.
• Existing tracker tests remain green.
• No hosted-service, authentication, payment, credential, or customer-data
  code is touched.

I will start only after explicit assignment, confirmation of this base/scope,
and either funded escrow or $15 upfront plus $15 after the agreed checks. XMR
or Base USDC can be settled at payment-time conversion.

You are also completely free to implement the report yourself; the technical
finding above is provided without charge. No branch or code has been started.

Disclosure: I used OpenAI Codex to assist with source inspection and drafting.
The repository and reproduction facts above were read back directly. Any work
and submission would remain explicitly AI-assisted and manually reviewed and
tested; that assistance would be disclosed in the PR.