Nextdoor browser pixels identify their pixel and event.

Nextdoor browser events use flask.nextdoor.com/pixel or /pixel-test. This pack checks pixel identity, standardized event names, page URLs and matching data serialized inside cd.

The pinned SDK uses GET and POST form transport. Producer checks and legacy event migration remain advisory. Blank referrers and supported prehash variants remain accepted.

What this pack matches

Hosts: flask.nextdoor.com
Paths: /pixel, /pixel-test
Vendor docs: developer.nextdoor.com/reference/universal-pixel

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`pid`	recommended	The SDK sends the configured pixel identity. Its identifier grammar is opaque. Presence diagnostic severity: warning.	`vendor.nextdoor-pixel.param.pid.missing` `vendor.nextdoor-pixel.param.pid.empty`	docs
`ev`	recommended	Universal Pixel documentation lists these events. Unknown or legacy event names receive migration advice. Presence diagnostic severity: warning.	`vendor.nextdoor-pixel.param.ev.missing` `vendor.nextdoor-pixel.param.ev.empty` `vendor.nextdoor-pixel.param.ev.invalid`	docs
`pl`	recommended	The SDK sends the current absolute page URL. Presence diagnostic severity: warning.	`vendor.nextdoor-pixel.param.pl.missing` `vendor.nextdoor-pixel.param.pl.empty` `vendor.nextdoor-pixel.param.pl.invalid`	docs
`cd`	optional	The SDK serializes custom and matching data as a JSON object.		docs
`rf`	optional	An empty referrer is normal. Presence diagnostic severity: warning.	`vendor.nextdoor-pixel.param.rf.empty` `vendor.nextdoor-pixel.param.rf.invalid`	docs
`ndclid_src`	optional	The SDK marks missing, URL-derived and cookie-derived click IDs with 0, 1 and 2. Presence diagnostic severity: warning.	`vendor.nextdoor-pixel.param.ndclid_src.empty` `vendor.nextdoor-pixel.param.ndclid_src.invalid`	docs
`v`	optional	Optional SDK bootstrap version. Presence diagnostic severity: warning.	`vendor.nextdoor-pixel.param.v.empty` `vendor.nextdoor-pixel.param.v.invalid`	docs
`sw`	optional	The SDK emits a nonnegative integer screen dimension, including zero. Presence diagnostic severity: warning.	`vendor.nextdoor-pixel.param.sw.empty` `vendor.nextdoor-pixel.param.sw.invalid`	docs
`sh`	optional	The SDK emits a nonnegative integer screen dimension, including zero. Presence diagnostic severity: warning.	`vendor.nextdoor-pixel.param.sh.empty` `vendor.nextdoor-pixel.param.sh.invalid`	docs
`root`	optional	The SDK emits an object; custom members remain open. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: object.	`vendor.nextdoor-pixel.body.root.invalid`	docs
`email`	optional	Manual matching accepts prehashed MD5, SHA-1, SHA-256 or SHA-512 hex in the pinned SDK. Digest correctness is external. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.nextdoor-pixel.body.email.empty` `vendor.nextdoor-pixel.body.email.invalid`	docs
`phone_number`	optional	Manual matching accepts prehashed MD5, SHA-1, SHA-256 or SHA-512 hex in the pinned SDK. Digest correctness is external. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.nextdoor-pixel.body.phone_number.empty` `vendor.nextdoor-pixel.body.phone_number.invalid`	docs
`first_name`	optional	Manual matching accepts prehashed MD5, SHA-1, SHA-256 or SHA-512 hex in the pinned SDK. Digest correctness is external. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.nextdoor-pixel.body.first_name.empty` `vendor.nextdoor-pixel.body.first_name.invalid`	docs
`last_name`	optional	Manual matching accepts prehashed MD5, SHA-1, SHA-256 or SHA-512 hex in the pinned SDK. Digest correctness is external. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.nextdoor-pixel.body.last_name.empty` `vendor.nextdoor-pixel.body.last_name.invalid`	docs
`gender`	optional	Manual matching accepts prehashed MD5, SHA-1, SHA-256 or SHA-512 hex in the pinned SDK. Digest correctness is external. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.nextdoor-pixel.body.gender.empty` `vendor.nextdoor-pixel.body.gender.invalid`	docs
`street_address`	optional	Manual matching accepts prehashed MD5, SHA-1, SHA-256 or SHA-512 hex in the pinned SDK. Digest correctness is external. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.nextdoor-pixel.body.street_address.empty` `vendor.nextdoor-pixel.body.street_address.invalid`	docs
`city`	optional	Manual matching accepts prehashed MD5, SHA-1, SHA-256 or SHA-512 hex in the pinned SDK. Digest correctness is external. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.nextdoor-pixel.body.city.empty` `vendor.nextdoor-pixel.body.city.invalid`	docs
`state`	optional	Manual matching accepts prehashed MD5, SHA-1, SHA-256 or SHA-512 hex in the pinned SDK. Digest correctness is external. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.nextdoor-pixel.body.state.empty` `vendor.nextdoor-pixel.body.state.invalid`	docs
`zip_code`	optional	Manual matching accepts prehashed MD5, SHA-1, SHA-256 or SHA-512 hex in the pinned SDK. Digest correctness is external. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.nextdoor-pixel.body.zip_code.empty` `vendor.nextdoor-pixel.body.zip_code.invalid`	docs
`country`	optional	Manual matching accepts prehashed MD5, SHA-1, SHA-256 or SHA-512 hex in the pinned SDK. Digest correctness is external. Decoded body source: cd. Encoding: json. Decoding diagnostic severity: warning. Presence diagnostic severity: warning. Native JSON type: string.	`vendor.nextdoor-pixel.body.country.empty` `vendor.nextdoor-pixel.body.country.invalid`	docs
`method`	recommended	The documented transport uses these methods. Complete HTTP capture contract. Presence diagnostic severity: warning.	`vendor.nextdoor-pixel.http.method.missing` `vendor.nextdoor-pixel.http.method.empty` `vendor.nextdoor-pixel.http.method.invalid`	docs
`method`	optional	Scope guard. Complete HTTP capture contract. Applies when {"kind":"value_in","param":"method","values":["POST"]}.		docs
`content_type`	recommended	The GET producer uses a form body when it switches to POST. Complete HTTP capture contract. Applies when {"kind":"value_in","param":"method","values":["POST"]}. Presence diagnostic severity: warning.	`vendor.nextdoor-pixel.http.content_type.missing` `vendor.nextdoor-pixel.http.content_type.empty` `vendor.nextdoor-pixel.http.content_type.invalid`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/nextdoor-pixel

Try this failing payload in the playground. A Nextdoor browser event missing pixel identity.

https://flask.nextdoor.com/pixel?ev=purchase&pl=https%3A%2F%2Fexample.test%2F

cargo install pixellint · npm install pixellint