Unapproved tags - Google Fonts

Products

• Clarity PPM On Premise

Issue/Introduction

We recently conducted a security scan of our environment and identified that Google Fonts is being used as an unapproved tag. Please note that Google Fonts is only permitted when Google reCAPTCHA is in use, which we have confirmed is not currently the case.

Resolution

Google Fonts (primarily Open Sans and Roboto) are deeply integrated into the application styling; however, the font files are hosted and served locally within the product environment.

The reason no relevant tags or external references are found is because the fonts are bundled directly with the product. There are no active links, scripts, or dynamic calls to fonts.googleapis.com or fonts.gstatic.com anywhere within the application.

Although the application UI utilizes open-source font families originally developed by Google (such as Open Sans and Roboto), the actual font files are packaged directly into the application assets and managed through secure internal packages (e.g., npm-font-open-sans).
These assets are served directly from servers running Clarity and are not fetched externally. 

The current font implementation within our environment is fully self-contained and locally hosted. As no user data, telemetry, or network requests are transmitted to Google, this architecture aligns with our security and privacy standards.

 At this time, no further remediation or code changes are required.

Additional Information

The 3rd party scanner likely generated a false positive by detecting font-family references (e.g., font-family: 'Open Sans') within locally hosted CSS files, rather than identifying any actual outbound network traffic to Google.