Security & privacy

Tracebird captures screens of real applications — the defaults are built so that doing the right thing requires zero configuration.

Masking, by default

• All input values are masked in DOM snapshots and session recordings — the masking happens at capture time, in the browser, so real values never enter a buffer.
• Passwords are always masked, with no way to opt out.
• Network bodies are never read; auth headers never leave the page.
• Testers can blur any region of a screenshot before sending — the pixels are destroyed client-side.

Transparency for testers

Recording is never silent: a pulsing REC badge with a live timer is visible for the entire duration of a test session, on every page. The report panel lists what is being captured before the tester hits send.

Abuse containment

The project key is public; the server contains it: per-project origin allowlists, indistinguishable 403s for bad keys and bad origins, rate limiting — each identified caller gets its own budget, with a per-IP backstop for anonymous traffic — an 8 MB request cap with per-field limits, and heavy media stripped from list endpoints so they can't be used to exfiltrate in bulk.

Data handling

• Screenshots and recordings live in a private bucket, never on a public URL. The dashboard serves them through links that expire in minutes, minted only after checking you belong to the workspace.
• Deleting a project cascades immediately to its reports, comments and stored media.
• Dashboard API access is server-to-server only — the token never reaches a browser.