Analyse: Messdienst: Ping ohne Einwilligung, Zeitstempel auf Stunde, Pfade ohne Kennungen

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

analytics/src/heat.js

@@ -35,7 +35,7 @@ export function verifyHeatToken(token, secret, nowMs, { ignoreExpiry = false } =
 export function createHeat({ db, config = {}, now }) {
   const clock = now || Date.now;
   const getSite = db.prepare('SELECT domains, active FROM sites WHERE siteKey = ?');
-  const getClicks = db.prepare('SELECT x, y FROM clicks WHERE site = ? AND path = ? AND vp = ? AND ts >= ? ORDER BY ts DESC LIMIT ?');
+  const getClicks = db.prepare('SELECT x, y FROM clicks WHERE site = ? AND path = ? AND vp = ? AND ts >= ? ORDER BY ts DESC, id DESC LIMIT ?');
 
   // CORS: nur die eigenen https-Domains der Website (das Overlay läuft auf der Kundenseite).
   function cors(res, req, domains) {