Masking and blocking

The recorder masks inputs and applies pattern-based redaction before events enter its ring buffer. Explicitly block sensitive regions: automatic patterns cannot classify all personal or confidential content.

Mark your interface

<!-- Preserve the region's structure while masking its text. -->
<section data-askdepth-mask>
  <p>Visitor-specific content</p>
</section>

<!-- Remove the region's recorded content and attributes. -->
<section data-askdepth-block>
  <h2>Private account details</h2>
  <p>Content that must not enter replay</p>
</section>

Add markers before recording begins. Masking after a secret has appeared cannot remove copies already uploaded. Blocking is appropriate when names, identifiers, or other sensitive values may appear in arbitrary attributes as well as text.

Automatic patterns

maskText recognizes patterns for email addresses, some phone/document numbers, Luhn-valid payment card numbers, labeled card numbers, JWTs, Bearer tokens, and labeled secret assignments. Pattern thresholds and formats are specific; unrecognized formats remain unchanged.

maskInputValue uses redaction markers when a pattern matches and otherwise returns stars matching the original input length. Layout-preserving stars still reveal length. Text masking preserves structure and may preserve whitespace, so it is not equivalent to removing a region.

The sanitizer clears placeholders, sanitizes selected label attributes, removes sensitive query parameters from some URLs, and masks sensitive data-* names. Ordinary attribute values, URL paths, fragments, arbitrary query keys, and arbitrary custom-event data are not comprehensively scrubbed.

Sanitize a stream

import { createEventSanitizer } from '@askdepth/replay';
import type { RRWebEvent } from '@askdepth/contracts';

const sanitizer = createEventSanitizer();

function sanitizeForBuffer(event: RRWebEvent): RRWebEvent {
  return sanitizer.sanitize(event);
}

// Call when discarding the recording stream.
sanitizer.clear();

The sanitizer clones JSON-compatible events and tracks masking and blocking IDs across full and incremental snapshots. A full snapshot resets its indexed node state. Do not reuse a sanitizer across unrelated simultaneous streams with overlapping node IDs.

Core-managed replay already uses a dedicated sanitizer. Do not assume that calling maskText on one string gives the same protection as the recorder's masking, event sanitizer, and explicit DOM markers together.

Verify sensitive flows

Exercise initial snapshots, dynamically added content, input changes, editable text, route transitions, and error states with test data. Inspect both retained events and uploaded payloads. Check labels, custom attributes, CSS URLs, and image/link paths in addition to visible text. Consent withdrawal stops future recording but is not a server deletion request.