mybinder.org adding request Origin to events archive
In February, the mybinder.org service will start tracking the “origin” of requests that launch a Binder session. The website that created a request to mybinder.org will be visible in the Binder analytics archive. This will help us monitor which websites are embedding Binder sessions for impact or abuse reports. It shouldn’t have any implications for private information but we are sharing here for transparency. The only cases where new information will be recorded is websites which embed mybinder.org kernels via tools like Thebe.
When folks use mybinder.org to run sessions, each launch is added to a public events archive. That means that every time anyone launches a session on mybinder.org, the repo and version used and the time of the launch is public information. There is no such thing as a private launch on mybinder.org (this is part of why we don’t support private repos). No information about the user requesting the build is recorded (ip address, user agent, browser info, etc.), though some of that is sent to Plausible and aggregated and anonymized for analytics. Notably, Plausible only covers regular browser visits, not launches via the API.
There are 3 main ways that people launch sessions on mybinder.org:
- (the vast majority) — visiting mybinder.org in a browser
- embedding kernels from mybinder.org on another website to make e.g. interactive documentation with a tool like Thebe
- ‘headless’ launches via scripts
Up to now, these events are indistinguishable in the events archive. We’d like to start distinguishing these cases in the events archive to better classify how mybinder.org is used, but that means recording new information we didn’t track before, so we want to communicate clearly about it ahead of time.
We are planning to add the Origin of the launch request to the public events archive at the end of February. This still doesn’t track anything about the user (no ip address, user agent, etc.), but rather the host of the page where the launch request originated. For the vast majority of cases, this is not new information, as the origin is e.g. gesis.mybinder.org (which we already track confusingly as ‘origin’, though this is not the request Origin, it is the federation member where the launch event takes place). Notably, case 1 still includes any regular browser links to mybinder.org/v1/gh/repo/name/HEAD. We don’t record where those come from (that would be Referer).
Where this changes is cross-origin requests (case 2), that is, pages which embed kernels from mybinder.org, such as documentation websites that use mybinder.org to embed kernels from mybinder.org via tools like Thebe to make executable documentation (which is rad!). These requests will now include the Origin of the request, which would be the hostname (e.g. https://course.spacy.io ), not the full page.
Script launches (case 3) typically lack this information, so will usually have null data in the new field. But of course, scripts can do whatever they want, so this isn’t guaranteed to be accurate for malicious or deliberately spoofing scripts.
If you want to have a private, not-recorded use of Binder, you must run your own BinderHub instance. If you want to suggest that we not do this, or do it differently, please let us know in the proposal discussion. You can also check the privacy policy for more information. We plan to apply the change at the end of February, 2026.
