Concepts

Privacy & data

Session replay, input traces, and console logs are sensitive by nature — and Fixback additionally feeds them into agent prompts. So the SDKs are private by default: sensitive data is masked and scrubbed before anything leaves the browser or server.

Masking, before capture

On the web, input values are masked before the screenshot is taken and before the replay is recorded — so private text never enters the captured image or the DOM recording in the first place. You can explicitly unmask an element where full fidelity matters (an internal or beta project can loosen this globally).

Scrubbing, before transport

Every report — human-sent or auto-captured — passes through the same client-side scrubbers:

URLs lose query strings and PII in path segments.
Console and error text loses emails, bearer tokens, and long digit runs.
Network crumbs are metadata-only — method, scrubbed URL, status, timing, sizes, content-type, and a failure classification. Never a request or response body, never a header.

On the backend

@fixback/node captures the route pattern (never the concrete path with values), the method, status, a correlation id, and an app-supplied user reference. It never sends request/response bodies, Authorization/Cookie headers, environment variables, or query-string values.

The beforeSend hook

Every SDK exposes a beforeSend choke point — the last chance to redact further, or to drop a report entirely by returning null. It runs on both human reports and automatic error captures.

ts

init({  key: "pk_live_…",  beforeSend(report) {    // Drop anything from an internal admin path entirely.    if (report.url?.includes("/admin")) return null;    return report;  },});