SAK-4120 has been implemented in 2.3 using permissions, it would be useful to have an explicit permission registered by Sitestats controlling who has ability to see site stats, viz. sitestats.view.
The tool could check that permission on startup and display an error message otherwise ("You do not have permission to view statistics for this site"), and include it by default in the tool reg file so that it won't be displayed on the menubar, ie.
<configuration name="functions.require" value="sitestats.view" />
We have several roles in course sites (Site owner, Lecturer, Support staff) whom we believe should have access to site stats, but there isn't a relevant permission shared by all (e.g. Lecturer doesn't have site.upd).