Redaction

Redaction runs at capture time. A token in a query string never reaches the buffer, which means it cannot be recovered from a report even by us — the difference between “we do not show it” and “we do not have it”.

Defaults

The engine is default-deny: element props and attributes are dropped unless they are known-safe. You opt things in, not out.

<TraceItXProvider
  config={{
    apiKey: 'txx_live_…',
    redaction: {
      maskInputs: ['email', 'tel', 'creditcard', 'ssn'],
      allowProps: ['data-testid', 'aria-label'],
    },
  }}
>

Credit-card detection is Luhn-validated, so a 16-digit order number is not mistaken for a card and blanked out of your report. Card and SSN masking are always on — listing them in maskInputs neither enables nor disables them.

Custom rules

For secrets whose shape only you know — an internal account format, a partner API’s token prefix:

redaction: {
  customRules: [
    { type: 'pattern', match: /acct_[A-Za-z0-9]{16}/g, replacement: '[account]' },
  ],
}

type picks what the rule applies to — 'pattern' for captured text, 'header' for request headers, 'urlParam' for query parameters. match is the regex (header and urlParam also accept a string), and replacement is optional.

Rules run over captured text: console messages, network URLs and headers, and body content when bodies are enabled.

What redaction does not cover

Pixels. A card number rendered on screen is caught by <Sensitive>, not by a redaction rule — the engine reads text, not images.

The replay. In the current release the rrweb stream is not passed through these rules. Wrap on-screen secrets in <Sensitive>; see Session replay.

Screen names. A route that embeds an email in the path becomes a navigation crumb verbatim. Fix the route or add a rule for it; see Screen tracking.

Server-side safety net

Ingest runs a subset of these rules again on arrival. It is idempotent and deliberately narrower than the client engine — it exists to catch an SDK that is old or misconfigured, not to replace client-side redaction. Never rely on it as your only line: by the time it runs, the data has already left the browser.