Issues

• Self-hosted instances send users' sign-in data to dash.better-auth.com (dash() plugin loaded without an API key)

  rybbit-io/rybbit#1325 · Filter by author Demivan opened on Oct 22, 2026

• Node CVE-2026-111497

  rybbit-io/rybbit#1318 · Filter by author FarisZR opened on Oct 22, 2026

• Clarify self-hosted feature policy and remaining IS_CLOUD UI gates

  rybbit-io/rybbit#1295 · Filter by author nicocart opened on Oct 3, 2026
  2

• Self-host: Query and Dashboards missing from sidebar since v2.9 (NEXT_PUBLIC_DEPLOYMENT baked empty in published client image)

  rybbit-io/rybbit#1294 · Filter by author millend opened on Oct 3, 2026
  1

• Possible bot detection false negatives: large volume of 0s / 1-page Direct sessions from rotating countries

  rybbit-io/rybbit#1264 · Filter by author nicocart opened on Sep 30, 2026
  3

• utm_medium values like "readme" or "download" are classified as Paid Unknown

  rybbit-io/rybbit#1262 · Filter by author sarmah-rup opened on Sep 29, 2026

• Rybbit instance shows "New Update" banner before release exists

  rybbit-io/rybbit#1242 · Filter by author HerrDerb opened on Sep 28, 2026

• First visit is the earliest event in the selected range, on Users and on Retention

  rybbit-io/rybbit#1222 · Filter by author zawasp opened on Sep 25, 2026

• Tracking script always persists a visitor ID in localStorage, which requires consent under ePrivacy / German TDDDG

  rybbit-io/rybbit#1221 · Filter by author raaaf opened on Sep 24, 2026
  4

• Defer WebGL bot probing until after the initial pageview response

  rybbit-io/rybbit#1204 · Filter by author attomus-gh opened on Sep 14, 2026

• New table (v2.9) migration query to copy existing metadata from v1 into v2

  rybbit-io/rybbit#1203 · Filter by author Artur-Su opened on Sep 14, 2026

• Configurable data retention for events (default: none)

  rybbit-io/rybbit#1194 · Filter by author jweisman11 opened on Sep 13, 2026
  1

• Embedded widget does not show any data

  rybbit-io/rybbit#1175 · Filter by author denisgomesfranco opened on Sep 4, 2026
  1

• Support Cloudflare visitor location headers with GeoLite2 fallback

  rybbit-io/rybbit#1174 · Filter by author nicocart opened on Sep 4, 2026

• list_sites MCP tool returns 401 with full access Organization API key

  rybbit-io/rybbit#1171 · Filter by author saamdotexe opened on Sep 3, 2026

• Guide to update coolify or dokploy projects

  rybbit-io/rybbit#1111 · Filter by author basarozcan opened on Aug 13, 2026
  1

• Docker images build on node:20-alpine, which is EOL and no longer receives rebuilds

  rybbit-io/rybbit#1110 · Filter by author jochristian opened on Aug 11, 2026

• Show the Integrations (Google Search Console) tab on self-hosted when Google OAuth is configured

  rybbit-io/rybbit#1106 · Filter by author iplanwebsites opened on Aug 5, 2026
  2

• Azerbaijan, China

  rybbit-io/rybbit#1101 · Filter by author Alex9001 opened on Aug 2, 2026
  2

• Alias/merge endpoint to stitch an anonymous identity to an account on login

  rybbit-io/rybbit#1098 · Filter by author kadam257 opened on Jul 31, 2026

• better-auth Failed to validate API key

  rybbit-io/rybbit#1095 · Filter by author FoxxMD opened on Jul 27, 2026

• Session replay recorder requires style-src 'unsafe-inline' — use CSSOM instead of string-based style writes

  rybbit-io/rybbit#1085 · Filter by author Metis77 opened on Jul 20, 2026
  1

• IP exclusion not working + same user counted as multiple sessions (cloud)

  rybbit-io/rybbit#1082 · Filter by author tgoarant opened on Jul 19, 2026
  3

• CORS misconfiguration + SameSite=None cookies enable cross-origin CSRF

  rybbit-io/rybbit#1038 · Filter by author geo-chen opened on Jul 3, 2026

• Add CSP headers for better security

  rybbit-io/rybbit#1035 · Filter by author pgrond opened on Jun 29, 2026