Recorder redaction
How recorders and the server mask sensitive data, and where that protection has limits.
Client and server masking
Recorders apply masking before upload, and the server applies the workspace policy again when it receives events. The policy supports credential-field masking and custom text patterns. It does not guarantee that every sensitive value will be recognised.
Default masking
Under the default policy the request and response headers authorization, proxy-authorization, cookie, set-cookie, x-api-key, x-auth-token, x-csrf-token and x-amz-security-token, plus any header ending in -api-key or -token, are replaced. Recognised body fields such as password, secret, token, access_token, refresh_token, id_token, client_secret, api_key, card numbers, cvv, pin and ssn are masked by key, whatever their casing or separators, and token-shaped URL query and fragment parameters are scrubbed. [redacted] marks where a value was removed.
Per-workspace patterns
Workspace admins extend the policy under Settings → Workspace → Members → Recording redaction, or at PUT /api/v1/recorder/policy: extra header names, extra body keys, and regular expressions whose matches are replaced wherever they occur in recorded request and response headers and bodies. A switch masks all text in DOM recordings. Every recorder — the browser extension and the in-app recorders — pulls the policy from GET /api/v1/recorder/policy when a session starts, and the server applies it again at ingest.
Body format limits
Key-wise redaction needs a body the server can parse: JSON, form-encoded and well-formed multipart. XML or SOAP bodies, unknown content types, and multipart that is truncated or malformed receive pattern-based scrubbing only — the always-scrubbed headers and the workspace patterns still apply, field names do not. Add a pattern for any secret your APIs carry in such a body.
Full fidelity
For a debugging workspace, an administrator can request full fidelity, which disables policy redaction. The server accepts this only with VITRINKA_RECORDER_FULL_FIDELITY=allow; the default is deny. The hosted deployment is configured to deny this mode.
Redaction is by key and by pattern, not by understanding. A secret inside free text that matches no pattern is captured as written — treat the workspace patterns as part of the recording setup, not an afterthought.