Sensitive User Data Transmitted Despite Disabled Telemetry

[Phaeilo]

What happened?

Cline v3.14.0 sends telemetry data containing sensitive user-generated content (tasks, links, filenames, MCP configuration) even when telemetry is explicitly disabled in settings.

Steps to reproduce

1. Install Cline v3.14.0
2. Populate "recent tasks" with at least one item (preferably containing clickable links)
3. Disable telemetry: Cline settings (wheel) > uncheck "Allow anonymous error and usage reporting"
4. Close Cline sidebar/tab
5. Open VSCode DevTools: Help > Toggle Developer Tools
6. Navigate to Network tab in DevTools
7. Open Cline
8. Interact with the UI:
   • Open recent task: click precisely on the task prompt
   • Exit task again
   • Repeat with other tasks (wait a few seconds between actions)
   • Also open tasks using the "History" view: again, click precisely on the task prompt
   • Collapse the gray "task title" box in a task, expand it again by clicking on the task prompt
   • Click on links in task output, if available
   • Expand & collapse file creation or modification dropdowns, if available
   • If configured, expand/collapse MCP server entries on MCP server settings page
9. Observe requests to posthog.com in DevTools Network tab
10. Right-click on request in DevTools: Copy > Copy all as HAR
11. Paste clipboard contents to file
12. Decode HAR file using the Python script provided below

Relevant API REQUEST output

Provider/Model

OpenAI Compatible

Operating System

Archlinux

System Info

not relevant

Cline Version

3.14.0

Additional context

Impact

Telemetry contains the text content of UI elements the user clicked on. This may include sensitive information, such as:

• User-created prompts/tasks
• Links clicked by the user
• Names of created/edited files
• Names of MCP servers

Affected Versions

• Confirmed in v3.14.0
• Not present in v3.13.1
• Other versions not tested

Workaround

• Avoid clicking on sensitive information in the UI
• Block network access to posthog.com
• Downgrade Cline to version that is not affected

Expected Fix

1. Honor telemetry setting
2. Even when telemetry is enabled, exclude user-generated content from collection
3. Specifically address the $el_text and $elements_chain fields in telemetry data

Decoding Script

#!/usr/bin/env python3

import datetime
import gzip
import json
import sys

jdoc = json.loads(sys.stdin.read())
text_items = []

for entry in jdoc["log"]["entries"]:
    req = entry["request"]
    if not req["url"].startswith("https://us.i.posthog.com/i/v0/e/?"):
        continue
    try:
        jreq = json.loads(gzip.decompress(bytes(req["postData"]["text"], "latin-1")))
    except Exception:
        continue

    print(json.dumps(jreq, indent=2))

    for event in jreq:
        el_text = event["properties"].get("$el_text")
        ts = datetime.datetime.fromtimestamp(event["properties"]["$time"])
        if el_text:
            text_items.append(f"{ts.isoformat()} {el_text!r}")

print("-" * 80)
for item in text_items:
    print(item)

[trevhud]

Hi @Phaeilo , thank you for bringing this to our attention. We had autocapture turned off on the posthog side and missed the fact that it needs to be off in the initialization as well. The PR has been merged and will be released today.

[pashpashpash]

@Phaeilo can you please confirm that this is fixed in the latest release? (3.14.1)

[Phaeilo]

Hey @trevhud thanks for the quick patch and release! The frequent telemetry events with sensitive data in $el_text and $elements_chain are no longer happening in v3.14.1! However, even with telemetry disabled in the settings I can still observe some requests to posthog: fetching some telemetry configuration, but also uploading a verbose $pageview when initially opening the extension.

[celestial-vault]

Hey @Phaeilo, we've just merged #3381 that conditionally initializes posthog in the webview. You should see less requests now, or if you do, they shouldn't be doing much of anything.

Would you mind confirming on the latest branch of main?

[pashpashpash]

Closing this as we confirmed it has been resolved. @Phaeilo if anything else comes up please feel free to open.