Redaction runs at capture time. A token in a query string never reaches the buffer, which means it cannot be recovered from a report even by us — the difference between “we do not show it” and “we do not have it”.
Defaults
The engine is default-deny: view properties are dropped unless known-safe,
and the rules are built in rather than configured. TraceItXConfig exposes
no redaction options — there is no maskInputs, allowProps or
customRules to pass.
What you get without doing anything: password fields masked in the screenshot and replay, credit-card-shaped strings Luhn-validated before redaction (so a 16-digit order number is not mistaken for a card), headers dropped unless allowlisted, and network URLs scrubbed before they reach the buffer.
Custom patterns
Not available on Android today. If you need a rule for a secret whose shape only
you know — an internal account format, a partner token prefix — keep it out of
logs and request URLs at the source, or use the iOS SDK’s customPatterns as
the model for what we would add. Tell us the shape and we will scope it.
What redaction does not cover
Pixels. A card number rendered on screen is caught by
markSensitive, not by a rule — the engine reads
text, not images.
Screen names, mostly. A name passed to recordScreen goes through the same
patterns as any crumb, so an obvious email or card number is caught — but an
order id or a username is not a shape the engine knows. See
Screen tracking.
Crash messages. An exception message is captured as thrown. Android’s own
NullPointerException messages name methods and types, not values — but your
own IllegalArgumentException("no such user jane@example.com") would reach the
report.
Server-side safety net
Ingest runs a subset of these rules again on arrival. It is idempotent and deliberately narrower than the client engine — it exists to catch an SDK that is old or misconfigured, not to replace client-side redaction. By the time it runs, the data has already left the device.