Redaction runs at capture time. A token in a query string never reaches the buffer, which means it cannot be recovered from a report even by us — the difference between “we do not show it” and “we do not have it”.
Defaults
The built-in rules are always on: JWT-shaped tokens, US social security numbers and Luhn-valid card numbers are replaced wherever they appear in captured text. You add to that set; you cannot switch it off.
init({
apiKey: 'txx_live_…',
redaction: {
maskInputs: ['email'],
},
});| Option | What it does |
|---|---|
maskInputs | Only email is consulted today — listing it turns on email masking. Card and SSN detection always run regardless of this list, and tel is currently unused. |
allowProps | Accepted for compatibility but has no effect: it filtered element props in the UI-tree capture, which has been removed. |
customRules | Your own patterns — see below. |
Credit-card detection is Luhn-validated, so a 16-digit order number is not
mistaken for a card and blanked out of your report. Card and SSN masking are
always on — listing them in maskInputs neither enables nor disables them.
Custom rules
For secrets whose shape only you know — an internal account format, a partner API’s token prefix:
init({
apiKey: 'txx_live_…',
redaction: {
customRules: [
{ type: 'pattern', match: /acct_[A-Za-z0-9]{16}/g, replacement: '[account]' },
],
},
});type picks what the rule applies to — 'pattern' for captured text,
'header' for request headers, 'urlParam' for query parameters. match is the
regex (header and urlParam also accept a string), and replacement is
optional.
Rules run over captured text: console messages, network URLs and headers, and body content when bodies are enabled.
What redaction does not cover
Pixels. A card number rendered on screen is caught by marking the element sensitive, not by a redaction rule — the engine reads text, not images.
The replay. In the current release the rrweb stream is not passed through these rules. Mark on-screen secrets as sensitive; see Session replay.
Screen names. A route that embeds an email in the path becomes a navigation crumb verbatim. Fix the route or add a rule for it; see Screen tracking.
Server-side safety net
Ingest runs a subset of these rules again on arrival. It is idempotent and deliberately narrower than the client engine — it exists to catch an SDK that is old or misconfigured, not to replace client-side redaction. Never rely on it as your only line: by the time it runs, the data has already left the browser.