In server/src/api/sessionReplay/recordSessionReplay.ts around lines 111-112, the
handler currently returns the raw Error object to clients (return
reply.status(500).send({ error })), which leaks internals and creates
inconsistent API responses; change it to log the full error server-side (with
request context or generated error id) and send a fixed, minimal JSON error
response to the client (e.g., { error: "Internal server error" } optionally with
an opaque errorId), keeping HTTP 500, and ensure logs include the original error
and any correlation id for debugging.

In server/src/services/sessions/sessionsService.ts around lines 28 to 36, the
current read-then-write flow (getExistingSession + insert) can create duplicate
active sessions under concurrency; replace it with a single atomic upsert:
change the DB schema (server/src/db/postgres/schema.ts) to make siteId NOT NULL
and add a unique constraint/index on (user_id, site_id) after backfilling/fixing
existing nulls and duplicate rows, then modify the service to perform one INSERT
... ON CONFLICT (user_id, site_id) DO UPDATE SET ... RETURNING session_id (or
the appropriate columns) instead of selecting first; ensure the returned row is
used and remove the separate getExistingSession call so session creation/upsert
is atomic.

In server/src/services/tracker/trackEvent.ts around lines 246 to 254, reinstate
server-side origin validation and add per-site auth controls: after loading
siteConfiguration, verify the request origin (from headers.origin or referer) is
present in siteConfiguration.allowed_origins and return 403 if not; introduce
and respect a boolean siteConfiguration.requireApiKey — when true, require and
validate an x-api-key or Authorization bearer token against keys stored on the
site configuration (support key rotation); when requireApiKey is false but the
site allows client keyless events, require an HMAC signature header and verify
it against a site secret to authenticate payload integrity; ensure any rejection
uses appropriate 4xx responses and logs. Also configure @fastify/cors in
server/src/index.ts to only allow the configured origins as a defense-in-depth
measure and update/add tests in server/src/analytics-script/tracking.test.ts to
cover origin rejection, API key enforcement, and HMAC verification paths.

In server/src/services/tracker/trackEvent.ts around line 292, update the call to
createBasePayload to include the new numericSiteId argument: pass a numeric
value (for example Number(validatedPayload.site_id) or the resolved site id
variable) as the fourth parameter. Ensure the value is a number (cast/validate
if necessary) and adjust any surrounding code to handle the returned
Promise<TotalTrackingPayload> as before.

In server/src/services/tracker/utils.ts around lines 88-90, avoid importing the
trackEvent runtime (which causes an ESM cycle) by changing the runtime import to
a type-only import and by referring to the trackEvent schema via an inline
typeof import so the schema reference is erased at runtime; specifically replace
any runtime import of ValidatedTrackingPayload/trackEvent with "import type {
ValidatedTrackingPayload } from './trackEvent'" and where you need the schema
use an inline typeof (e.g. type Schema = typeof
import('./trackEvent').trackingPayloadSchema) so no runtime module is loaded,
and update the local alias to the type-only name (ValidatedTrackingPayload)
accordingly.