Please report vulnerabilities privately through GitHub's security advisory feature for this repository. Do not include tokens, private URLs, customer data, or other secrets in a public issue.

tracking-param-check sends HTTP GET requests only to URLs supplied by the user and destinations named by their HTTP redirect responses. Custom headers are not forwarded when a redirect changes host or port. Run the tool only against systems you are authorized to test.