Privacy and redaction

Faylee captures a lot about a page so a developer can fix the bug: requests with their headers and bodies, console output, and every click and keystroke. Some of that is private. Faylee hides secrets in the browser, before anything is uploaded, so they never reach Faylee’s servers, your bucket or the assistant.

There are three layers:

Redaction replaces secret values in the captured data with [redacted].
Masking blurs or hides parts of the page itself, in videos, screenshots and the page replay.
Blocking keeps whole sites out of captures.

What is hidden automatically

These rules always apply. Nobody can turn them off.

Headers

The values of these request and response headers are hidden:

authorization and proxy-authorization
cookie and set-cookie
x-api-key, x-auth-token, x-csrf-token, x-xsrf-token and x-amz-security-token

Fields and keys

Faylee hides the value of any key in JSON bodies, form bodies, query parameters, console objects and app metadata when its name looks sensitive. A name is compared in lowercase with everything but letters and digits removed. It is hidden when it:

is auth, pin, session or sid,
contains password, passwd, secret, apikey, privatekey, cardnumber, ccnumber, cvv, cvc or ssn, or
ends with token, cookie, sessionid, otp, iban or authorization.

So access_token, X-Session-Id and cardNumber are all hidden.

Values that look like credentials

Wherever they appear in addresses, header values, bodies, console messages, error messages and socket messages, Faylee also hides:

JSON Web Tokens.
Bearer, Basic and Token credentials.
A user name and password inside an address, as in https://user:password@example.com.

What redaction leaves alone

Redaction does not change the device details, Web Vitals, page titles, or console and error stack traces. The page’s DOM is protected by masking instead, described below.

Masking parts of your page

Masking hides what is on the page itself. A masked element is blurred on screen while Faylee records a video or takes a screenshot, so it is blurred in the image. Its text is masked in the page replay, and anything typed into it is recorded as a hidden value in the steps.

These are always masked:

Password fields.
Fields whose autocomplete is a credit card value (cc-number, cc-csc and the other cc- values), one-time-code, new-password or current-password.

To mask anything else on your site, add the data-faylee-mask attribute or the faylee-mask class. It masks the element and everything inside it.

<div class="account-summary" data-faylee-mask>
  <p>Balance: $12,480.00</p>
  <p>IBAN: DE89 3704 0044 0532 0130 00</p>
</div>

<span class="faylee-mask">jane.doe@example.com</span>

This works for the extension and the site widget. People recording can also blur parts of the page by hand while they record, and pixelate parts of a screenshot before they share it. See Recording tools.

Your own rules in the extension

Each person can add to the built-in rules in the extension’s settings, under Privacy:

Never capture these sites: one host per line, such as bank.example.com. Subdomains are included.
Also hide these headers: one header name per line.
Also hide these fields: JSON keys, form fields and query parameters, one per line.

The same page lists what your workspace adds, under Your workspace also blocks and Your workspace also hides.

Before sharing a capture, you can also leave out its console, network or steps entirely, or remove single failed requests. See Review and share.

Workspace privacy rules

Workspace admins set rules that every member’s extension applies, under Settings, Privacy, Privacy rules:

Rule	What it does
Never capture these sites	Hosts that are never captured, one per line. Subdomains are included.
Always hide these headers	Header names hidden in every capture, one per line.
Always hide these fields	JSON keys, form fields and query parameters hidden in every capture, one per line.
Allow instant replay	When off, no member’s extension keeps a rolling replay of pages. Recordings and screenshots still work.

Press Save rules to apply them. Changes are recorded in the audit log.

Members can add to the workspace’s rules in their own extension, but they can’t remove them. Each extension fetches the rules when it starts, when it connects to your workspace, and every hour after that.

The site widget applies the workspace’s header and field rules to every report too.

Sites Faylee never captures

On a site in Never capture these sites, the extension captures nothing at all: no console, no network, no steps, no replay. Opening the popup there says that Faylee is off on this site, and whether you or your workspace’s policy blocked it.

The extension also never captures browser pages, such as settings and the new tab page, or the Chrome Web Store.

Incognito windows

The extension never keeps an instant replay in an incognito window, even when instant replay is on. Whether Faylee runs in incognito at all is up to you: Chrome runs an extension there only when you allow it in the extension’s details.

Retention

Admins can also have old recordings deleted automatically. See Storage and retention.