Replay privacy

redactionStrategy modes, selectors, password protection, canvas, and verification.

Why this matters

Replays reconstruct on-screen UI from rrweb snapshots. Without redaction, typed values and sensitive labels can be stored and played back.

Configure at init

HumanBehaviorTracker.init(apiKey, {
  redactionStrategy: {
    mode: "privacy-first", // default
    unredactFields: ['input[name="email"]', "#public-search"],
  },
});

Or start open and mask selectively:

HumanBehaviorTracker.init(apiKey, {
  redactionStrategy: {
    mode: "visibility-first",
    redactFields: ['input[name="ssn"]', "[data-hb-redact=\"true\"]"],
  },
});

Modes

Mode	Default input behavior	Selector lists
`privacy-first` (default)	`maskAllInputs: true` — inputs masked; text masked unless unredacted	`unredactFields`: CSS selectors to show
`visibility-first`	Inputs visible by default; passwords and listed fields masked	`redactFields`: CSS selectors to hide; if omitted, defaults to `input[type="password"]` and `[data-hb-redact="true"]`

Password fields are always protected. Selectors that target password inputs are rejected from unredact lists (warning logged). Visibility-first always includes password selectors in the redact set.

DOM helpers

Attribute / class	Role
`data-hb-redact="true"`	Default mark for visibility-first redaction
`data-no-redact="true"` / `.human-behavior-no-redact`	Exclude selectors recognized by `RedactionManager`
`rr-mask`	Class applied at runtime for visibility-first targets

Runtime helpers

tracker.setUnredactedFields(['input[name="email"]']);
tracker.getUnredactedFields();
tracker.hasUnredactedFields();

Prefer configuring redactionStrategy at init for production; runtime helpers are for dynamic UIs.

rrweb recording knobs tied to privacy

Init option	Default	Privacy note
`recordCanvas`	`false`	Opt-in; when on, samples ~4 FPS WebP at quality 0.4
`suppressConsoleErrors`	`true`	Reduces rrweb/CORS console noise only — not a privacy control
`captureRequestBodies`	`false`	Keep off unless you need error-correlated bodies (redacted)
`enableConsoleTracking`	`true`	Console may contain secrets — see Console & network

Input masking options enabled for common types: password, text, textarea, email, number, tel, url, search, date, time, month, week. Masking fails closed (masks on error).

Deprecated option

Option	Status
Top-level `redactFields: string[]`	Deprecated — treated as a legacy unredact list; migrate to `redactionStrategy`

Operational checklist

Do not console.warn / console.error tokens/PII if console capture is on (console.log is not ingested)
Do not put secrets in customEvent properties
Review Privacy model for product surfaces that can show data
Verify masking on a staging session before production rollout

Verify

Record a session that includes password fields and any marked sensitive inputs.
Open Replays → player viewport.
Confirm passwords never appear in clear text; confirm unredacted / redacted selectors behave as configured.