# Errors

URL: /docs/sdk/errors

> Crash capture, readable stack traces, and keeping the noise out.

Error capture is on by default: uncaught exceptions and unhandled rejections
  become [issues](/docs/product/issues), grouped by fingerprint, each with the
  replays of the sessions that hit them.

## Report one yourself

For errors you catch and handle but still want to know about:

```ts
tracker.captureException(error);
```

In React, wrap a subtree so a render crash is reported instead of only blanking
the UI:

```tsx
import { HumanBehaviorErrorBoundary } from "humanbehavior-js/react";

<HumanBehaviorErrorBoundary>
  <Checkout />
</HumanBehaviorErrorBoundary>;
```

`captureException` never throws — a reporting failure will not take your app
down with it.

## Stamp the build

Without this, a stack trace points into a minified bundle and you are guessing
which deploy it came from.

```ts
HumanBehaviorTracker.init(apiKey, {
  release: "web@2026.8.28",
  environment: "production",
  commitSha: process.env.COMMIT_SHA,
});
```

`release` pairs with your uploaded source maps so a trace resolves to your
original source. `commitSha` turns frames into links to the line on GitHub.
`dist` distinguishes two builds of the same release.

## Upload source maps

Upload them at build time, after the bundle is produced, using the same `release`
you pass to `init`:

```bash
npx @humanbehavior/wizard upload-sourcemaps ./dist \
  --release "web@2026.8.28" --api-key "$HUMANBEHAVIOR_API_KEY"
```

Point it at the directory holding your built assets and maps. The `--release`
must match the one you pass to `init`, or a trace has nothing to resolve against.

## Drop the noise

Third-party scripts, browser extensions, and cancelled navigations generate
errors that are not yours. Filter them in the browser so they never become
issues:

```ts
HumanBehaviorTracker.init(apiKey, {
  ignoreErrors: ["ResizeObserver loop limit exceeded", /^Network request failed/],
  denyUrls: [/extensions\//, /^chrome:\/\//],
});
```

- `ignoreErrors` — substring or RegExp against the message.
- `denyUrls` — drop errors from matching script URLs.
- `allowUrls` — when set, keep **only** errors from matching URLs. The blunt way
  to restrict reporting to your own code.

By default only first-party resource failures are reported; set
`captureThirdPartyResourceErrors: true` to include cross-origin ones.

**Request bodies are opt-in**

  `captureRequestBodies: true` attaches redacted request and response bodies to
  error-correlated requests. It makes debugging much faster and it means more of
  your users' data leaves the browser. Read
  [Masking and PII](/docs/sdk/privacy) before enabling it.

## Also captured

`console.warn` and `console.error` are recorded, as are failed and slow network
requests, so a replay shows the console and network state at the moment of the
crash. Both are opt-out via `enableConsoleTracking` and `enableNetworkTracking`.