Mask Sensitive PostHog Session Replay Data
Configure replay privacy before recording sensitive journeys, then validate actual captured output. Text masking, input handling and network or console collection are different surfaces that need separate review.
Before you start: Have engineering access to the SDK configuration and project settings, an agreed privacy policy and synthetic test data. Do not test redaction using real secrets.
Worked example: A billing page contains a name, invoice details and a reveal-password control. Verify those surfaces with fake values and confirm the recording never exposes the sensitive information.
Step-by-step guide
Inventory sensitive surfaces
List inputs, visible text, images and any captured logs or network content. Identify what the team needs to observe and what it must never collect.
Choose conservative rules
For PostHog Web, set session_recording: { maskAllInputs: true, maskTextSelector: "*" } as a conservative starting point. Input masking covers input values; the text selector covers non-input text. Review other SDKs against their own documentation.
Implement before capture
Apply the configuration before recording starts. For a whole sensitive element, add the ph-no-capture class; this also prevents autocapture on that element. Review network and console capture separately because DOM masking does not cover every surface.
Test synthetic journeys
Record fake personal data through normal, error and reveal states. Inspect the resulting recording and any enabled auxiliary capture.
Check dynamic content
Repeat the test after route changes, modal opening and asynchronous updates. A rule that covers initial markup may miss another rendering path.
Record and maintain the policy
Document safe exceptions and an owner. Repeat the check after component or SDK changes and stop collection if the required protection cannot be verified.
Common mistakes
Inputs only
Sensitive text can appear outside form fields. Review the complete screen.
Masking fixes old recordings
Do not assume a new rule sanitizes previously captured data. Follow the appropriate retention or deletion process.
Real secrets used in tests
Synthetic values are enough to verify masking without creating a new exposure.
Tips
Include password-reveal behavior in the test cases.
Review network and console capture separately.
Keep a regression test for newly introduced sensitive components.
Sources and verification
Based on product documentation checked on 2026-10-24. This is a documentation-based guide, not a hands-on benchmark. Features and availability can change.