[CI] (e2f7ab0) flask/flask3-social-media

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: e2f7ab0
App: flask/flask3-social-media
App directory: apps/flask/flask3-social-media
Workbench branch: wizard-ci-e2f7ab0-flask-flask3-social-media
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-07-06T21:59:06.431Z
Duration: 430.0s

YARA Scanner

✓ 55 tool calls scanned, 0 violations detected

No violations: ✓ 55 clean scans

[wizard-ci-bot]

PR Evaluation Report

Summary

This PR integrates PostHog analytics into a Flask 3 social media (Microblog) application. It adds the PostHog Python SDK, initializes it in create_app() with exception autocapture, and instruments 14 events across authentication, content creation, social interactions, messaging, search, and API endpoints. Person properties are set via posthog_client.set() on login and registration.

Files changed	Lines added	Lines removed
9	+135	-3

Confidence score: 4/5 👍

• Username in person properties via set(): The username is set as a person property, which is acceptable for person profiles, but should be noted as borderline PII depending on the app's username policy. [LOW]
• No .env.example updated: The PR adds .env to .gitignore and documents env vars in config.py, but no .env.example file is committed to show collaborators which variables to set. The setup report even calls this out as a TODO. [MEDIUM]
• Search query not captured but search results are: The post_search_performed event captures result_count and page but omits the search query itself, which is good for PII avoidance but limits search analytics. This is a reasonable tradeoff. [LOW]

---

File changes

Filename	Score	Description
app/__init__.py	5/5	Initializes PostHog client with Posthog() constructor, enable_exception_autocapture=True, and registers atexit.register(posthog_client.shutdown)
config.py	4/5	Adds POSTHOG_PROJECT_TOKEN and POSTHOG_HOST from env vars with sensible defaults
requirements.txt	5/5	Adds posthog dependency
app/auth/routes.py	5/5	Instruments login, logout, registration, password reset request/completion with proper distinct IDs
app/main/routes.py	5/5	Instruments post creation, profile update, follow/unfollow, search, messaging, and export with enriched properties
app/api/tokens.py	5/5	Captures api_token_created with user's distinct ID
app/api/users.py	5/5	Captures api_user_created with signup method property
.gitignore	5/5	Adds .env to gitignore
posthog-setup-report.md	4/5	Setup report documenting all events and next steps

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	No syntax errors, valid imports, SDK properly added to requirements
Preserves existing env vars & configs	Yes	All existing config preserved, PostHog additions are additive
No syntax or type errors	Yes	All code is syntactically valid Python
Correct imports/exports	Yes	from posthog import Posthog is correct; current_app imports added where needed
Minimal, focused changes	Yes	Only PostHog-related changes, no unnecessary refactoring
Pre-existing issues	None	Base app appears functional

Issues

• No .env.example committed: The PR adds env vars POSTHOG_PROJECT_TOKEN and POSTHOG_HOST but doesn't update or create a .env.example file for collaborators. The setup report itself acknowledges this gap. [MEDIUM]

Other completed criteria

• Build configuration is valid — posthog added to requirements.txt without version pinning issues
• Existing app code and functionality fully preserved
• All imports resolve correctly (Posthog from posthog, current_app from flask)

---

PostHog implementation ✅

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog added to requirements.txt
PostHog client initialized	Yes	Posthog() constructor used in create_app() with API key from env, host from env, and enable_exception_autocapture=True. Client stored on app.posthog_client. atexit.register(posthog_client.shutdown) ensures clean shutdown.
capture()	Yes	14 meaningful capture() calls across auth, content, social, messaging, search, and API routes
identify()	N/A	Server-only Flask app — N/A
Error tracking	Yes	enable_exception_autocapture=True set in constructor
Reverse proxy	N/A	Server-only app — N/A

Issues

None.

Other completed criteria

• API key loaded from environment variable via app.config['POSTHOG_PROJECT_TOKEN'] → os.environ.get('POSTHOG_PROJECT_TOKEN', '')
• Host correctly configured with default https://us.i.posthog.com
• atexit.register(posthog_client.shutdown) properly registered for clean event flushing
• Instance-based API used (Posthog() constructor) rather than module-level config

---

PostHog insights and events ✅

Filename	PostHog events	Description
app/auth/routes.py	user_logged_in, user_logged_out, user_registered, password_reset_requested, password_reset_completed	Full auth lifecycle with remember_me and signup_method properties. Person properties set via set() on login and registration
app/main/routes.py	post_created, profile_updated, user_followed, user_unfollowed, post_search_performed, message_sent, posts_export_started	Content creation, social, search, messaging, and export events with enriched properties
app/api/tokens.py	api_token_created	API token generation tracking
app/api/users.py	api_user_created	API user registration with signup_method: 'api' property

Issues

None.

Other completed criteria

• Events represent real user actions mapping to actual product flows (registration → login → post → follow → message)
• Events enable product insights — funnel from registration to first post, retention via logins, social engagement via follows
• Events include relevant enriched properties: post_language, post_length, result_count, message_length, signup_method, remember_me, has_about_me
• No PII in event properties — username is correctly set via set() as person properties, not in capture() event properties. User IDs in properties (followed_user_id, recipient_id, unfollowed_user_id) are numeric IDs, not PII
• Event naming is consistent snake_case with descriptive [noun]_[verb] pattern

---

Reviewed by wizard workbench PR evaluator