Security Assessment

Callix.io

External Attack Surface Assessment — 13 findings identified across the Callix.io platform

📅 August 23, 2026 🔒 Authorized Assessment ⚡ 1 High Severity ⚠️ 5 Medium Severity
1
High
5
Medium
4
Low
3
Info

Attack Surface Overview

flowchart TD subgraph Platform["Callix.io Platform"] APP["app.callix.io\nNext.js / Vercel"] CONVEX["Convex Backend\nfabulous-cobra-808"] CLERK["Clerk Auth"] PIXEL["Pixel Endpoint\n/v1/pixel/track"] end subgraph Customers["Customer Websites"] C1["Customer Sites\ndata-callix-id exposed"] end subgraph Dev["Exposed Environments"] D1["dev.callix.io"] D2["demo.callix.io"] D3["feature.callix.io"] D4["old.callix.io"] end C1 -->|"No auth"| PIXEL PIXEL --> CONVEX APP --> CLERK APP --> CONVEX CLERK --> CONVEX style PIXEL fill:#ef4444,stroke:#fca5a5,stroke-width:2px,color:#fff style C1 fill:#f97316,stroke:#fdba74,stroke-width:2px,color:#fff style D1 fill:#27272a,stroke:#52525b,color:#d4d4d8 style D2 fill:#27272a,stroke:#52525b,color:#d4d4d8 style D3 fill:#27272a,stroke:#52525b,color:#d4d4d8 style D4 fill:#27272a,stroke:#52525b,color:#d4d4d8 style APP fill:#18181b,stroke:#3f3f46,color:#d4d4d8 style CONVEX fill:#18181b,stroke:#3f3f46,color:#d4d4d8 style CLERK fill:#18181b,stroke:#3f3f46,color:#d4d4d8

The pixel tracking endpoint accepts requests from any source without authentication. Customer account IDs are publicly visible in website HTML.

Key Finding

F-07: Unauthenticated Pixel Tracking Endpoint

The pixel tracking endpoint accepts POST requests from anyone, with no authentication. Customer account IDs are publicly exposed in website HTML, meaning any visitor can send tracking events to any customer's account.

Critical Risk

Fake Tracking Data Injection

Third parties can inject fake visitor tracking events into customer accounts, polluting attribution data and metrics.

Critical Risk

Ad Platform Poisoning

If conversion data is sent to Meta/Google for pixel conditioning, fake events could train ad algorithms on incorrect data.

High Risk

No Rate Limiting

The endpoint has no rate limiting, allowing unlimited requests from any source without throttling.

High Risk

Unsanitized Input Storage

The pageUrl field accepts unsanitized input including HTML and script content, creating stored XSS risk.

All Findings

ID Finding Severity CWE
F-01API Key Embedded in MCP URL PathMediumCWE-200
F-02CORS Misconfiguration on Convex BackendsLow-MedCWE-942
F-03Over-Permissive API Keys (No Scoping)MediumCWE-285
F-04Potential Subdomain TakeoverLow-MedCWE-350
F-05Exposed Development EnvironmentsLowCWE-200
F-06Non-Existent npm PackageInfo—
F-07Unauthenticated Pixel Tracking EndpointHighCWE-306
F-08Customer Account IDs Publicly ExposedMediumCWE-200
F-09No Rate Limiting on Pixel EndpointMediumCWE-770
F-10Error Messages Leak Schema InformationLow-MedCWE-209
F-11Unsanitized Input in pageUrl FieldMediumCWE-79
F-12Anonymous Convex WebSocket AccessLowCWE-306
F-13Partial Authentication BypassLow-MedCWE-285

Recommendations

Immediate Actions

  • Add authentication or request signing to the pixel tracking endpoint
  • Add rate limiting per IP and per account
  • Sanitize pageUrl field to prevent stored XSS
  • Move API keys from URL paths to headers

Short-term Improvements

  • Implement API key scoping
  • Restrict CORS to known origins
  • Remove wildcard DNS for *.preview.callix.io
  • Restrict access to development environments

Need Help With Remediation?

This report covers findings from an external security assessment. For a more comprehensive assessment including authenticated testing, source code review, and detailed remediation guidance, a follow-up engagement can be arranged.

Callix.io Security Assessment — 2026-08-23 — Authorized by operator — All testing was limited to verification of vulnerability existence