@scalebun/react-native 1.10.4 → 1.10.6

package/ios/Core/DeviceIdentity.swift

@@ -0,0 +1,50 @@
+import Foundation
+
+/**
+ * The ONE place that answers "which iPhone is this?".
+ *
+ * iOS ships no API for the name a person would recognise. `UIDevice.current.model` returns the
+ * FAMILY — the literal string "iPhone" or "iPad" — which is identical on an iPhone 6 and an
+ * iPhone 17 Pro, so a dashboard grouping by it sees one bucket holding every iOS device ever.
+ * `ReplaySdk.getDeviceInfo` sent exactly that, which is why the replay lane could never tell two
+ * iPhones apart.
+ *
+ * The hardware identifier from `uname()` — "iPhone16,2" — is the only thing the OS will tell us,
+ * and it is unique per model. It is not the marketing name and this module does not pretend
+ * otherwise: turning "iPhone16,2" into "iPhone 15 Pro Max" needs a lookup table, and that table
+ * belongs on the server, where a device released after this binary shipped can be named without
+ * waiting for every app to adopt a new SDK and ship to the App Store.
+ *
+ * `ScaleBunProfilerModule` already had this function privately; both lanes now share it so they
+ * cannot drift into reporting two different models for one device.
+ */
+@objc(ScaleBunDeviceIdentity)
+public final class ScaleBunDeviceIdentity: NSObject {
+
+    /**
+     * The hardware identifier, e.g. "iPhone16,2" / "iPad14,3".
+     *
+     * On the simulator `uname` reports the HOST architecture ("x86_64", "arm64"), so the
+     * simulator's own hint is preferred when present — otherwise every developer's simulator
+     * session lands in the dashboard as a device model named after a CPU.
+     */
+    @objc public static func modelIdentifier() -> String {
+        if let simulator = ProcessInfo.processInfo
+            .environment["SIMULATOR_MODEL_IDENTIFIER"], !simulator.isEmpty {
+            return simulator
+        }
+        var systemInfo = utsname()
+        uname(&systemInfo)
+        let identifier = withUnsafePointer(to: &systemInfo.machine) {
+            $0.withMemoryRebound(to: CChar.self, capacity: 1) {
+                String(validatingUTF8: $0) ?? ""
+            }
+        }
+        // Empty rather than "Unknown": an absent measurement must not arrive looking like a value.
+        return identifier
+    }
+
+    // No manufacturer constant here on purpose. iOS's manufacturer is answerable without the
+    // bridge — the platform being iOS entails it — so staticDeviceContext() sets it on the FIRST
+    // event rather than waiting for a native round-trip that may never come back.
+}

package/ios/Profiler/ScaleBunProfilerModule.swift

@@ -392,15 +392,9 @@ class ScaleBunProfilerModule: RCTEventEmitter {
         sendEvent(withName: "ScaleBunProfiler_Capabilities", body: buildCapabilities())
     }
 
+    /** Shared with the replay lane so the two cannot report different models for one device. */
     private func deviceModel() -> String {
-        var systemInfo = utsname()
-        uname(&systemInfo)
-        let modelCode = withUnsafePointer(to: &systemInfo.machine) {
-            $0.withMemoryRebound(to: CChar.self, capacity: 1) {
-                String(validatingUTF8: $0) ?? "Unknown"
-            }
-        }
-        return modelCode
+        return ScaleBunDeviceIdentity.modelIdentifier()
     }
 
     private func isDebugBuild() -> Bool {

package/ios/ReplaySdk.swift

@@ -572,7 +572,9 @@ class ReplaySdk: RCTEventEmitter {
         resolve([
             "platform": "ios",
             "osVersion": device.systemVersion,
-            "deviceModel": device.model,
+            // NOT device.model — that is the family ("iPhone"), identical on every iPhone ever
+            // made. ScaleBunDeviceIdentity reports the hardware identifier, which is unique per model.
+            "deviceModel": ScaleBunDeviceIdentity.modelIdentifier(),
             "screenWidth": Int(screen.bounds.width * screen.scale),
             "screenHeight": Int(screen.bounds.height * screen.scale),
             "pixelDensity": screen.scale,

package/lib/commonjs/analytics/EventTracker.js

@@ -341,6 +341,28 @@ class EventTracker {
     this.persistQueue();
   }
 
+  /**
+   * Fold in device facts that were not knowable at init.
+   *
+   * `Platform.constants` answers Android synchronously, so its model and manufacturer ride the
+   * very first event. iOS exposes neither there — only the native bridge knows, and the bridge is
+   * async and may not be installed at all. Without this the iOS half of every install reported no
+   * model whatsoever.
+   *
+   * `buildEnvelope` reads `cfg.context` per event, so applying it here reaches every event from
+   * the next one onward. Detected keys WIN over whatever the integrator configured, for the same
+   * reason `mergeDeviceContext` inverts the usual precedence: a measurement must not be
+   * overridable by a guess. Empty patches are ignored so a bridge that answered with nothing
+   * cannot blank a value the static path already found.
+   */
+  applyDetectedContext(patch) {
+    if (!patch || Object.keys(patch).length === 0) return;
+    this.cfg.context = {
+      ...(this.cfg.context ?? {}),
+      ...patch
+    };
+  }
+
   // ─── internals ─────────────────────────────────────────────────────────────
 
   buildEnvelope(eventName, properties) {

package/lib/commonjs/bootstrap/SDKBootstrapper.js

@@ -322,6 +322,22 @@ class SDKBootstrapper {
     if (features.replay !== false) {
       try {
         __DEV__ && _internalLogger.logger.debug('[Bootstrap] Initializing unified SessionManager');
+        // SB-10: map the public top-level privacy config onto the replay
+        // privacy policy — the field the native capture path actually reads.
+        // Unspecified fields fall back to the SDK's safe defaults
+        // (redactTextInputs: true), so this only ever tightens masking.
+        const pub = this.config.privacy ?? {};
+        const sessionReplay = {
+          ...(this.config.replay ?? {})
+        };
+        if (typeof pub.maskTextInputs === 'boolean' || typeof pub.maskImages === 'boolean') {
+          sessionReplay.privacyPolicy = {
+            redactTextInputs: pub.maskTextInputs ?? true,
+            redactImages: pub.maskImages ?? false,
+            blockTestIds: [],
+            captureExclusions: []
+          };
+        }
         const sessionManager = _SessionManager.SessionManager.getInstance(null,
         // No desktop transport initially
         _nativeCapture.nativeCapture,
@@ -331,9 +347,7 @@ class SDKBootstrapper {
         // Also flow the Feature #4 heatmap flag so tap/gesture coords
         // route to the analytics lane even when no recording is active.
         {
-          ...(this.config.replay ? {
-            sessionReplay: this.config.replay
-          } : {}),
+          sessionReplay: sessionReplay,
           captureInteractionHeatmap: this.config.captureInteractionHeatmap === true
         });
 

package/lib/commonjs/core/config/schema.js

@@ -245,6 +245,35 @@ const SHAPE = {
       })
     }
   },
+  // SB-10: the public, documented top-level privacy config. Previously only the
+  // nested replay privacy took effect; this is validated here and mapped onto the
+  // effective replay privacy policy in the bootstrapper so it actually masks.
+  privacy: {
+    kind: 'obj',
+    opt: true,
+    shape: {
+      maskTextInputs: {
+        kind: 'bool',
+        opt: true
+      },
+      maskImages: {
+        kind: 'bool',
+        opt: true
+      },
+      redactAuth: {
+        kind: 'bool',
+        opt: true
+      },
+      redactCookies: {
+        kind: 'bool',
+        opt: true
+      },
+      redactBodies: {
+        kind: 'bool',
+        opt: true
+      }
+    }
+  },
   captureInteractionHeatmap: bool(true),
   // Opt-in: intercept console.* and ship the lines to the Diagnose → Logs lane in SaaS
   // mode. OFF by default — console output can carry PII/secrets and adds ingest volume,

package/lib/commonjs/core/constants/version.js

@@ -9,5 +9,5 @@ exports.SDK_VERSION = void 0;
  * can attribute telemetry to the SDK build that produced it.
  * Keep in sync with package.json "version".
  */
-const SDK_VERSION = exports.SDK_VERSION = '1.10.4';
+const SDK_VERSION = exports.SDK_VERSION = '1.10.6';
 //# sourceMappingURL=version.js.map

package/lib/commonjs/core/context/device.js

@@ -104,6 +104,10 @@ function staticDeviceContext() {
   if (osVersion) out.os_version = String(osVersion);
   if (c.Model) out.device_model = String(c.Model);
   if (c.Manufacturer) out.manufacturer = String(c.Manufacturer);else if (c.Brand) out.manufacturer = String(c.Brand);
+  // iOS exposes no manufacturer because it does not need to: every device running iOS is Apple's.
+  // A tautology, not a guess — and it means the field is populated on event #1 rather than waiting
+  // for a bridge that may never answer.
+  else if (out.platform_os === 'ios') out.manufacturer = 'Apple';
   return out;
 }
 
@@ -113,6 +117,7 @@ function nativeDeviceContext(info) {
   if (!info) return out;
   if (info.osVersion) out.os_version = info.osVersion;
   if (info.deviceModel) out.device_model = info.deviceModel;
+  if (info.manufacturer) out.manufacturer = info.manufacturer;
   return out;
 }
 

package/lib/commonjs/debug/redaction.js

@@ -21,29 +21,80 @@ exports.scanObjectForPII = scanObjectForPII;
 
 const REDACTED = '[REDACTED]';
 
+// ─── Safety limits (SB-25 / SB-27) ───────────────────────────────────────────
+// The PII scanner runs synchronously on the JS thread inside the app's own
+// fetch()/XHR call. Left unbounded it is both a ReDoS vector (a large body of
+// alphanumeric text can make regex matching cost seconds — an Android ANR) and
+// a payload-amplification / exfiltration channel (one warning object per match).
+// These bounds keep every scan linear and its output small.
+
+/** Never scan more than this many characters — truncate before matching. */
+const MAX_SCAN_INPUT_CHARS = 16 * 1024;
+/** Abandon a scan once it has spent this long on the JS thread. */
+const SCAN_TIME_BUDGET_MS = 10;
+/** Never emit more than this many PII warnings for a single event. */
+const MAX_PII_WARNINGS = 20;
+/** Never pattern-scrub a string value longer than this (bounded work). */
+const MAX_STRING_SCRUB_CHARS = 64 * 1024;
+
 /** Headers that must always be redacted (case-insensitive) */
 const SENSITIVE_HEADERS = new Set(['authorization', 'cookie', 'set-cookie', 'x-api-key', 'x-auth-token', 'proxy-authorization']);
 
-/** PII detection patterns */
+/**
+ * PII detection patterns.
+ *
+ * SB-25: patterns must be free of catastrophic backtracking. The email pattern
+ * uses non-overlapping character classes with bounded quantifiers so it cannot
+ * backtrack quadratically on adversarial input like `'a'.repeat(N) + '@' + …`.
+ * All quantifiers here are bounded; combined with the input cap above this keeps
+ * matching linear in input size.
+ */
 const PII_PATTERNS = [{
   name: 'email',
-  pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g
+  pattern: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63}){0,8}\.[A-Za-z]{2,24}/g
 }, {
   name: 'phone',
-  pattern: /(?:\+?\d{1,3}[-.\s]?)?\(?\d{2,4}\)?[-.\s]?\d{3,4}[-.\s]?\d{3,4}/g
+  pattern: /\+?\d{1,3}[-.\s]?\(?\d{2,4}\)?[-.\s]?\d{3,4}[-.\s]?\d{3,4}/g
 }, {
   name: 'ssn',
   pattern: /\b\d{3}-\d{2}-\d{4}\b/g
 }, {
   name: 'credit_card',
   pattern: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b/g
+}, {
+  name: 'iban',
+  pattern: /\b[A-Z]{2}\d{2}[A-Z0-9]{10,30}\b/g
+}, {
+  name: 'jwt',
+  pattern: /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b/g
 }, {
   name: 'ip_address',
   pattern: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g
 }];
 
+/**
+ * Value patterns used to scrub secrets out of raw string bodies (SB-02).
+ * These are applied to string values (including parsed-out JSON string leaves
+ * and non-JSON bodies) where a denylisted key name is not available. All are
+ * bounded / anchored to avoid backtracking.
+ */
+const VALUE_SCRUB_PATTERNS = [{
+  name: 'jwt',
+  pattern: /eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g
+}, {
+  name: 'email',
+  pattern: /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63}){0,8}\.[A-Za-z]{2,24}/g
+}, {
+  name: 'iban',
+  pattern: /\b[A-Z]{2}\d{2}[A-Z0-9]{10,30}\b/g
+}, {
+  name: 'credit_card',
+  pattern: /\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{2,7}\b/g,
+  luhn: true
+}];
+
 /** Keys in request/response bodies that likely contain sensitive data */
-const SENSITIVE_BODY_KEYS = new Set(['password', 'passwd', 'secret', 'token', 'access_token', 'refresh_token', 'api_key', 'apiKey', 'private_key', 'privateKey', 'credit_card', 'creditCard', 'ccNumber', 'cvv', 'ssn', 'social_security']);
+const SENSITIVE_BODY_KEYS = new Set(['password', 'passwd', 'secret', 'token', 'access_token', 'refresh_token', 'id_token', 'api_key', 'apiKey', 'private_key', 'privateKey', 'credit_card', 'creditCard', 'ccnumber', 'cardnumber', 'card_number', 'pan', 'cvv', 'cvc', 'ssn', 'social_security', 'nationalid', 'national_id', 'iban', 'otp', 'pin', 'totp', 'mfa', 'mnemonic', 'seed']);
 
 // ─── Header Redaction ───────────────────────────────────────────────────────
 
@@ -70,9 +121,68 @@ function redactHeaders(headers) {
 
 // ─── Body Redaction ─────────────────────────────────────────────────────────
 
+/** Normalize a key for denylist comparison: lowercase, strip separators. */
+function _normalizeKey(key) {
+  return key.toLowerCase().replace(/[_\-\s]/g, '');
+}
+
+/** Normalized denylist so `access_token`, `accessToken` and `Access-Token` all match. */
+const NORMALIZED_SENSITIVE_KEYS = new Set(Array.from(SENSITIVE_BODY_KEYS, _normalizeKey));
+function _isSensitiveKey(key) {
+  return NORMALIZED_SENSITIVE_KEYS.has(_normalizeKey(key));
+}
+
+/** Passes the Luhn checksum — used to avoid over-redacting random 16-digit ids. */
+function _luhnValid(digits) {
+  const s = digits.replace(/[^\d]/g, '');
+  if (s.length < 12 || s.length > 19) return false;
+  let sum = 0;
+  let alt = false;
+  for (let i = s.length - 1; i >= 0; i--) {
+    let d = s.charCodeAt(i) - 48;
+    if (alt) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    alt = !alt;
+  }
+  return sum % 10 === 0;
+}
+
+/**
+ * Scrub structured secrets (JWT, email, IBAN, Luhn-valid card) out of a raw
+ * string value where no denylisted key name is available (SB-02). Bounded work:
+ * the string is capped and every pattern is anchored/bounded.
+ */
+function _scrubSecretsInString(value) {
+  if (value.length > MAX_STRING_SCRUB_CHARS) {
+    value = value.slice(0, MAX_STRING_SCRUB_CHARS);
+  }
+  let out = value;
+  try {
+    for (const {
+      pattern,
+      luhn
+    } of VALUE_SCRUB_PATTERNS) {
+      pattern.lastIndex = 0;
+      out = out.replace(pattern, m => luhn && !_luhnValid(m) ? m : REDACTED);
+    }
+  } catch {
+    // Never throw — return whatever scrubbing produced so far.
+  }
+  return out;
+}
+
 /**
  * Deep-redact sensitive keys in a body object. Returns a new object.
  * Handles nested objects and arrays. Never throws.
+ *
+ * SB-02: string bodies (what JSON.stringify produces — i.e. essentially every
+ * React Native network body) are no longer passed through untouched. If a string
+ * parses as JSON it is deep-redacted and re-serialized; otherwise structured
+ * secrets in the string are scrubbed. This closes the "6 of 9 seeded secrets
+ * survived" leak while leaving non-sensitive metadata intact.
  */
 function redactBody(body, maxDepth = 10) {
   try {
@@ -85,9 +195,7 @@ function _redactValue(value, depth, maxDepth) {
   if (depth > maxDepth) return '[MAX_DEPTH]';
   if (value === null || value === undefined) return value;
   if (typeof value === 'string') {
-    // Don't deeply redact strings at the value level here,
-    // PII scanning is a separate concern
-    return value;
+    return _redactString(value, depth, maxDepth);
   }
   if (Array.isArray(value)) {
     return value.map(item => _redactValue(item, depth + 1, maxDepth));
@@ -95,7 +203,7 @@ function _redactValue(value, depth, maxDepth) {
   if (typeof value === 'object') {
     const result = {};
     for (const [key, val] of Object.entries(value)) {
-      if (SENSITIVE_BODY_KEYS.has(key) || SENSITIVE_BODY_KEYS.has(key.toLowerCase())) {
+      if (_isSensitiveKey(key)) {
         result[key] = REDACTED;
       } else {
         result[key] = _redactValue(val, depth + 1, maxDepth);
@@ -106,66 +214,145 @@ function _redactValue(value, depth, maxDepth) {
   return value;
 }
 
+/**
+ * Redact a string value. If it looks like a JSON object/array, parse it, redact
+ * by key, and re-serialize so a serialized body such as
+ * `{"password":"...","otp":"..."}` is scrubbed. Otherwise scrub structured
+ * secrets out of the raw text.
+ */
+function _redactString(value, depth, maxDepth) {
+  const trimmed = value.trimStart();
+  if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+    try {
+      const parsed = JSON.parse(value);
+      if (parsed !== null && typeof parsed === 'object') {
+        const redacted = _redactValue(parsed, depth + 1, maxDepth);
+        return JSON.stringify(redacted);
+      }
+    } catch {
+      // Not valid JSON — fall through to pattern scrubbing.
+    }
+  }
+  return _scrubSecretsInString(value);
+}
+
 // ─── PII Scanning ───────────────────────────────────────────────────────────
 
 /**
- * Scan a string for PII patterns. Returns list of warnings.
- * Never throws.
+ * Bounded scan context shared across one logical scan (SB-25 / SB-27). Enforces
+ * a wall-clock budget and a warning cap while accumulating per-type counts so the
+ * final output can report `{ email: 5000 }` instead of 5000 fragment objects.
  */
-function scanForPII(text, location = 'unknown') {
-  const warnings = [];
+
+function _newScanContext() {
+  return {
+    warnings: [],
+    byType: {},
+    deadline: Date.now() + SCAN_TIME_BUDGET_MS,
+    truncated: false,
+    total: 0
+  };
+}
+function _pushWarning(ctx, type, rawMatch, location) {
+  ctx.total += 1;
+  ctx.byType[type] = (ctx.byType[type] ?? 0) + 1;
+  if (ctx.warnings.length < MAX_PII_WARNINGS) {
+    ctx.warnings.push({
+      type,
+      match: _maskPII(rawMatch),
+      location
+    });
+  } else {
+    ctx.truncated = true;
+  }
+}
+
+/**
+ * Finalize a scan: append a single summary entry carrying per-type counts when
+ * anything was dropped, so consumers see the full magnitude without the SDK
+ * shipping every matched fragment (SB-27).
+ */
+function _finalizeScan(ctx) {
+  if (ctx.truncated) {
+    ctx.warnings.push({
+      type: '_summary',
+      match: `truncated: ${ctx.total} matches`,
+      location: `counts:${JSON.stringify(ctx.byType)}`
+    });
+  }
+  return ctx.warnings;
+}
+function _scanTextInto(text, location, ctx) {
+  // SB-25: cap the input before any regex runs, so matching cost is bounded
+  // regardless of the (attacker-controlled) body size.
+  const input = text.length > MAX_SCAN_INPUT_CHARS ? text.slice(0, MAX_SCAN_INPUT_CHARS) : text;
   try {
     for (const {
       name,
       pattern
     } of PII_PATTERNS) {
-      // Reset regex state
       pattern.lastIndex = 0;
-      let match = pattern.exec(text);
+      let match = pattern.exec(input);
       while (match) {
-        warnings.push({
-          type: name,
-          match: _maskPII(match[0]),
-          location
-        });
-        match = pattern.exec(text);
+        _pushWarning(ctx, name, match[0], location);
+        // SB-25: abandon the scan if it has exceeded its time budget.
+        if (Date.now() > ctx.deadline) {
+          ctx.truncated = true;
+          return;
+        }
+        if (pattern.lastIndex === match.index) pattern.lastIndex++; // guard zero-width
+        match = pattern.exec(input);
       }
     }
   } catch {
-    // Never throw — return whatever we found so far
+    // Never throw — keep whatever was found so far.
   }
-  return warnings;
 }
 
 /**
- * Scan an object deeply for PII. Returns list of warnings.
+ * Scan a string for PII patterns. Returns a bounded list of warnings.
+ * Never throws.
+ */
+function scanForPII(text, location = 'unknown') {
+  const ctx = _newScanContext();
+  _scanTextInto(text, location, ctx);
+  return _finalizeScan(ctx);
+}
+
+/**
+ * Scan an object deeply for PII. Returns a bounded list of warnings.
  * Never throws.
  */
 function scanObjectForPII(obj, basePath = '', maxDepth = 10) {
-  const warnings = [];
+  const ctx = _newScanContext();
   try {
-    _scanObject(obj, basePath, 0, maxDepth, warnings);
+    _scanObjectInto(obj, basePath, 0, maxDepth, ctx);
   } catch {
     // Never throw
   }
-  return warnings;
+  return _finalizeScan(ctx);
 }
-function _scanObject(value, path, depth, maxDepth, warnings) {
+function _scanObjectInto(value, path, depth, maxDepth, ctx) {
   if (depth > maxDepth || value === null || value === undefined) return;
+  if (ctx.truncated || Date.now() > ctx.deadline) {
+    ctx.truncated = true;
+    return;
+  }
   if (typeof value === 'string') {
-    const found = scanForPII(value, path);
-    warnings.push(...found);
+    _scanTextInto(value, path, ctx);
     return;
   }
   if (Array.isArray(value)) {
-    value.forEach((item, i) => {
-      _scanObject(item, `${path}[${i}]`, depth + 1, maxDepth, warnings);
-    });
+    for (let i = 0; i < value.length; i++) {
+      if (ctx.truncated) return;
+      _scanObjectInto(value[i], `${path}[${i}]`, depth + 1, maxDepth, ctx);
+    }
     return;
   }
   if (typeof value === 'object') {
     for (const [key, val] of Object.entries(value)) {
-      _scanObject(val, path ? `${path}.${key}` : key, depth + 1, maxDepth, warnings);
+      if (ctx.truncated) return;
+      _scanObjectInto(val, path ? `${path}.${key}` : key, depth + 1, maxDepth, ctx);
     }
   }
 }
@@ -207,20 +394,19 @@ function redactUrl(url) {
  * Apply full redaction pipeline to a network event.
  */
 function redactNetworkEvent(event) {
-  const piiWarnings = [];
-
-  // Scan URL for PII
+  // One bounded context for the whole event so the aggregate warning count and
+  // scan time stay capped across url + request + response (SB-25 / SB-27).
+  const ctx = _newScanContext();
   if (event.url) {
-    piiWarnings.push(...scanForPII(event.url, 'url'));
+    _scanTextInto(event.url, 'url', ctx);
   }
-
-  // Scan bodies for PII
   if (event.requestBody) {
-    piiWarnings.push(...scanObjectForPII(event.requestBody, 'requestBody'));
+    _scanObjectInto(event.requestBody, 'requestBody', 0, 10, ctx);
   }
   if (event.responseBody) {
-    piiWarnings.push(...scanObjectForPII(event.responseBody, 'responseBody'));
+    _scanObjectInto(event.responseBody, 'responseBody', 0, 10, ctx);
   }
+  const piiWarnings = _finalizeScan(ctx);
   return {
     url: event.url ? redactUrl(event.url) : '',
     method: event.method ?? 'GET',

package/lib/commonjs/features/journey/ScaleBunDebugRoot.js

@@ -583,7 +583,15 @@ function ScaleBunDebugRoot({
               });
             }
           } catch {/* no-throw */}
-        }, 200);
+          // 600ms, was 200ms. The race this defer exists for happens on the FIRST tap of a
+          // mount: native isn't confirmed yet, JS emitted at 200ms, then the first native
+          // event crossed the bridge at ~300-400ms — recording the same tap TWICE, with the
+          // JS copy missing normalizedX/Y whenever the async root-view measure hadn't
+          // resolved (an interaction the heatmap cannot place). QA hit exactly this pair.
+          // The wider defer lets the first native event cancel the JS emission instead; on
+          // devices with no native tracker at all it merely delays a background emission,
+          // which nothing user-visible waits on.
+        }, 600);
       }
       touchStartRef.current = null;
     } catch {/* no-throw */}