# Recorder redaction (https://docs.vitrinka.ai/security/redaction)



## Client and server masking [#policy]

Recorders apply masking before upload, and the server applies the workspace policy again when it receives events. The policy supports credential-field masking and custom text patterns. It does not guarantee that every sensitive value will be recognised.

## Default masking [#always]

Under the default policy the request and response headers `authorization`, `proxy-authorization`, `cookie`, `set-cookie`, `x-api-key`, `x-auth-token`, `x-csrf-token` and `x-amz-security-token`, plus any header ending in `-api-key` or `-token`, are replaced. Recognised body fields such as `password`, `secret`, `token`, `access_token`, `refresh_token`, `id_token`, `client_secret`, `api_key`, card numbers, `cvv`, `pin` and `ssn` are masked by key, whatever their casing or separators, and token-shaped URL query and fragment parameters are scrubbed. `[redacted]` marks where a value was removed.

## Per-workspace patterns [#patterns]

Workspace admins extend the policy under **Settings → Workspace → Members → Recording redaction**, or at `PUT /api/v1/recorder/policy`: extra header names, extra body keys, and regular expressions whose matches are replaced wherever they occur in recorded request and response headers and bodies. A switch masks all text in DOM recordings. Every recorder — the browser extension and the in-app recorders — pulls the policy from `GET /api/v1/recorder/policy` when a session starts, and the server applies it again at ingest.

## Body format limits [#boundary]

Key-wise redaction needs a body the server can parse: JSON, form-encoded and well-formed multipart. XML or SOAP bodies, unknown content types, and multipart that is truncated or malformed receive pattern-based scrubbing only — the always-scrubbed headers and the workspace patterns still apply, field names do not. Add a pattern for any secret your APIs carry in such a body.

## Full fidelity [#fidelity]

For a debugging workspace, an administrator can request full fidelity, which disables policy redaction. The server accepts this only with `VITRINKA_RECORDER_FULL_FIDELITY=allow`; the default is `deny`. The hosted deployment is configured to deny this mode.

<Callout type="warn">
  Redaction is by key and by pattern, not by understanding. A secret inside free text that matches no pattern is captured as written — treat the workspace patterns as part of the recording setup, not an afterthought.
</Callout>