Three things arrive in the console’s address bar and should not stay there: the token in an invite or join link, the tokens an identity provider returns on the callback, and the join token carried into the login page. The analytics library records the arrival URL, so those could have reached our product analytics as a property of a page event.
The console now captures the query and fragment and rewrites the address to the bare path in an inline script that runs before the analytics library initializes, on six routes. The library is also told to drop URL fragments and to mask the credential parameters by name, and error reports carry origin and path only. The model refresh stream, which carried its bearer in the URL, sends it in a header instead.
Sign-out is one primitive that every door calls: the visible Log out, the MFA
step-up, the consent page and the backup-code reset. It ends an admin’s
impersonation session first, then clears every store (the Supabase session, the
legacy token, the org record, the pending join token, the lifecycle cookie and
the analytics identity) in a finally, whether or not the network cooperated.