Appearance
Data exposure checks
Replay also looks at what the pages really loaded for secrets, personal data and trackers. These checks only read traffic the replay already makes; nothing extra is sent.
What is found
| Finding | Level | Where it looks |
|---|---|---|
| Secret visible in a page or script (AWS key, private key, GitHub, Slack or Stripe token, Google API key) | Low to Critical | Text responses up to 1 MB |
| Payment card number visible (passes the Luhn check) | High | Text responses up to 1 MB |
| Secret, token, email or card in a web address | Medium | Request addresses |
Login token, email or card kept in localStorage or sessionStorage | Low (Info for an email) | Browser storage after each step |
| Trackers or tracking cookies before the first interaction | Info | Requests and Set-Cookie before the first click or typing |
Each finding carries the impact, a fix, the CWE and the OWASP Top 10 (2021) reference, like every other check.
What is kept
Only a masked preview: the type and the first characters of a key (AKIA…), the last four digits of a card, the name of a parameter or storage key. The full value is never written to the report, the HTML, the baseline or SARIF. Storage values are classified in memory and dropped.
Limits
- The consent check is a hint, not a legal opinion: it reports trackers loaded before you interacted with the page.
- Only the first 1 MB of each text response is scanned, and binary files are skipped.
- Pattern matching finds well-known formats; it cannot find every secret.
Switch it off
--no-exposure skips these checks. Use the policy file to switch off or re-rate a single check.