Ackee currently derives referrer favicons from the referrer URL itself, which causes the dashboard to request /favicon.ico from localhost and loopback addresses when those appear as referrers. That can trigger browser prompts about accessing local applications and looks suspicious to operators.

• UI behavior

  • Route referrer favicon generation through a dedicated helper instead of constructing new URL('/favicon.ico', item.url) inline.
  • Return no favicon URL for local-only referrers:
    • localhost
    • *.localhost
    • 127.0.0.0/8
    • ::1
  • Preserve existing behavior for non-local referrers.

• Safety boundaries

  • Limit the change to favicon URL generation in the referrers presentation.
  • Do not alter referrer collection, normalization, storage, or API output.

• Coverage

  • Add focused tests for:
    • public hostnames
    • localhost
    • localhost subdomains
    • IPv4 loopback
    • IPv6 loopback
    • public IPv4 addresses

export default (url) => {
  if (url == null || isLocalHostname(url.hostname)) return

  return new URL('/favicon.ico', url).href
}