Masking and PII

What the recorder masks, and how to choose between hiding by default and showing by default.

Pick a posture, not a checklist

There are two modes, and the choice is about what happens to a field nobody thought about:

HumanBehaviorTracker.init(apiKey, {
  redactionStrategy: {
    mode: "privacy-first",
    unredactFields: [".product-title", "#plan-name"],
  },
});

privacy-first (the default) hides input content by default. You name the things that are safe to show with unredactFields. A new form field added next quarter is masked automatically — nobody has to remember.

visibility-first shows by default, and you name what to hide with redactFields. Replays are more useful, and a new field ships unmasked until someone notices.

redactionStrategy: {
  mode: "visibility-first",
  redactFields: ["#card-number", "[name=ssn]", ".customer-email"],
}

Use privacy-first if you handle anything regulated. The failure mode of the other one is a screenshot of a credit card in your own tooling.

Adjust at runtime

tracker.setRedactedFields(["#card-number"]);
tracker.setUnredactedFields([".product-title"]);

React has a hook for the same thing:

import { useRedaction } from "humanbehavior-js/react";

Two other things worth deciding

Canvas is not recorded unless you set recordCanvas: true. If your product draws customer data into a canvas, leave it off.

Request bodies are not attached to error reports unless you set captureRequestBodies: true. They are redacted when they are attached, but this is still the single biggest increase in what you collect — see Errors.

Your own event payloads are your responsibility

Redaction covers what is on screen. It does not inspect the properties you pass to customEvent or identifyUser — those you send deliberately, so do not send tokens, passwords, or full card numbers. propertyDenylist on init blocks specific property names everywhere.