What gets captured

You are putting this on a client's production site. Here is the whole story, so you can repeat it to them.

Never captured

• Request and response headers
• Cookies
• Query strings. Every recorded URL is stored as origin plus path. That is where tokens live, so they are dropped before anything is stored
• console.log. Only warn and error are wrapped. Logs routinely carry customer data and would crowd out real warnings
• Anything from a data:, blob: or file: URL. These carry their whole payload in what looks like a URL, and recording one would smuggle page content past the masking rules

There is no setting that turns any of these on.

Captured always

• Browser, OS, viewport, pixel ratio, language, the raw user-agent string
• The page URL, minus its query string
• JavaScript errors from your own code
• Console warnings and errors from your own code
• Failed requests: method, URL, status, duration
• A screenshot, with passwords and your masked selectors blurred

Console and error buffers hold the most recent 50 entries each.

Captured only if you ask

Request and response bodies. Off by default, failures only, first-party only, redacted in the browser, truncated to 2 kB. See Project settings.

"Your code" versus "someone else's"

There is no blacklist of analytics vendors — that covers a fraction of the web and rots within a year. One rule decides:

Something is first-party if it comes from the page's own origin, from anything sharing its registrable domain (so cdn.acme.com counts for www.acme.com), or from one of the project's configured API origins.

What that changes:

A third party's script chattering in the console is noise. A third party's request failing is evidence, and might be the bug — so failures are never filtered by ownership.

When warnings are left out, the report says so: "12 further warnings came from third-party scripts and were not recorded." Nothing is dropped silently.

Development noise

Bundler plumbing is dropped before it reaches the buffer: Vite's /@fs/ and /@vite/, /node_modules/, webpack hot updates. Same origin as your app, but never anyone's bug.

This matters more than it sounds. A real admin app produced 18 font 403s from Vite's module server, which read as "18 failed requests" on a report where nothing was actually failing — and evicted the API calls that mattered out of a 50-entry buffer.

Screenshots

Taken in the browser, uploaded to private storage, and only ever handed out as signed links that expire — an hour in the app, a week in a tracker issue. The bucket is never public.

Masking happens before the image exists: the elements are blurred, the picture is taken, the page is put back.

The reporter's link

Someone who files a report gets a link like /r/pf3n8qk2mxv9wdhe. It shows the status, the team's updates, and a box to reply. There is no account and no password — the token in the URL is the whole thing, which is why it is long and unguessable.

Anyone with that link can read that one report and comment on it. Treat it the way you would treat a private document link.