@spotify-confidence/csr-recorder 0.17.21 → 0.17.22

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.17.22](https://github.com/spotify/confidence-sdk-js/compare/csr-recorder-v0.17.21...csr-recorder-v0.17.22) (2026-09-18)
+
+
+### ✨ New Features
+
+* add capture sanitization controls ([#468](https://github.com/spotify/confidence-sdk-js/issues/468)) ([971a9d9](https://github.com/spotify/confidence-sdk-js/commit/971a9d9d6ef6db8e82126e9caf91f7403512d3e2))
+
 ## [0.17.21](https://github.com/spotify/confidence-sdk-js/compare/csr-recorder-v0.17.20...csr-recorder-v0.17.21) (2026-09-17)
 
 

package/README.md

@@ -27,6 +27,23 @@ const stop = record(
 stop();
 ```
 
+Raw URLs and console output can contain sensitive data from first-party or third-party code. Both capture options record
+raw values when set to `true`. Select a sanitization policy before you enable these channels in production.
+
+Set `sanitize: true` to remove query strings and fragments from network URLs and from URLs inside console payloads and
+traces:
+
+```typescript
+const stop = record(event => {}, {
+  captureNetworkRequests: { sanitize: true },
+  captureConsoleLogs: { levels: ['warn', 'error'], sanitize: true },
+});
+```
+
+Set `sanitize` to `(value: string) => string` for a custom policy. See
+[`@spotify-confidence/session-recording`](../session-recording/README.md#sanitizing-console-and-network-capture) for the
+full description, including the fail-closed behavior.
+
 ## Route parameterization
 
 Routes containing dynamic segments (such as IDs in the URL) are automatically normalized into patterns — for example, `/users/123/profile` becomes `/users/:id/profile`. This ensures that per-page metrics are grouped by route rather than by individual page visit, keeping dashboards meaningful and query performance fast.

package/dist/index.cjs

@@ -64,6 +64,48 @@ function extractGraphQLRequestMetadata(url, body) {
 	return operationName ? { operationName } : void 0;
 }
 //#endregion
+//#region src/capture-sanitizer.ts
+const URL_IN_TEXT = /(?:(?:https?|wss?):)?\/\/[^\s<>"')\]}]+/giu;
+const RELATIVE_URL_IN_TEXT = /(^|[\s("'=])(\/(?!\/)[^\s<>"')\]}]*[?#][^\s<>"')\]}]*)/giu;
+/** Remove query strings and fragments from every URL found inside free text. */
+function stripUrlsInText(value) {
+	return value.replace(URL_IN_TEXT, _spotify_confidence_csr_common.stripUrlQueryAndHash).replace(RELATIVE_URL_IN_TEXT, (_match, prefix, url) => prefix + (0, _spotify_confidence_csr_common.stripUrlQueryAndHash)(url));
+}
+const BUILT_IN = {
+	network: _spotify_confidence_csr_common.stripUrlQueryAndHash,
+	console: stripUrlsInText
+};
+/** The sanitizer for one capture channel, or `undefined` when that channel stays raw. */
+function getValueSanitizer(sanitizer, source) {
+	if (!sanitizer) return void 0;
+	const sanitize = sanitizer === true ? BUILT_IN[source] : sanitizer;
+	return (value) => {
+		const sanitized = sanitize(value);
+		if (typeof sanitized !== "string") throw new TypeError("Sanitizer must return a string");
+		return sanitized;
+	};
+}
+/** Log at most once. Diagnostics must never reach the host application. */
+function createOnceLogger(debugLogger) {
+	let hasLogged = false;
+	return (message) => {
+		if (hasLogged) return;
+		hasLogged = true;
+		try {
+			debugLogger?.(message);
+		} catch (_error) {}
+	};
+}
+/** Build a captured event. Returns `undefined` when sanitizing threw, so the caller drops it. */
+function dropOnFailure(build, warn, source) {
+	try {
+		return build();
+	} catch (_error) {
+		warn(`SECURITY: ${source} sanitizer failed; captured event dropped`);
+		return;
+	}
+}
+//#endregion
 //#region src/recorder.ts
 var Recorder = class Recorder {
 	engine;
@@ -78,6 +120,8 @@ var Recorder = class Recorder {
 	originalReplaceState = null;
 	popstateHandler = null;
 	parameterizeRoute;
+	sanitizeNetworkUrl;
+	warnNetworkDrop = createOnceLogger();
 	constructor(options) {
 		this.engine = options.engine;
 		this.onEvent = options.onEvent;
@@ -89,6 +133,8 @@ var Recorder = class Recorder {
 		if (this.state === "recording") return;
 		this.state = "recording";
 		this.parameterizeRoute = config?.parameterizeRoute ?? defaultParameterizeRoute;
+		this.sanitizeNetworkUrl = getValueSanitizer(typeof config?.captureNetworkRequests === "object" ? config.captureNetworkRequests.sanitize : void 0, "network");
+		this.warnNetworkDrop = createOnceLogger(config?.debugLogger);
 		this.engine.start(config ?? {}, (event) => {
 			if (event.type === _spotify_confidence_csr_common.RecordingEventType.Meta) {
 				const data = event.data;
@@ -125,7 +171,13 @@ var Recorder = class Recorder {
 		if (config?.captureNetworkRequests) this.patchNetwork();
 		if (config?.captureRouteChanges !== false) this.patchRouting();
 	}
-	emitNetworkRequest(payload) {
+	emitNetworkRequest(raw) {
+		const sanitizeUrl = this.sanitizeNetworkUrl;
+		const payload = sanitizeUrl ? dropOnFailure(() => ({
+			...raw,
+			url: sanitizeUrl(raw.url)
+		}), this.warnNetworkDrop, "network") : raw;
+		if (!payload) return;
 		const data = {
 			plugin: _spotify_confidence_csr_common.RecordingPluginName.NetworkRequest,
 			payload
@@ -11118,7 +11170,7 @@ const getRecordConsolePlugin = (options) => ({
 	options
 });
 //#endregion
-//#region src/engine/rrweb-engine.ts
+//#region src/engine/console-capture-plugin.ts
 const ALL_CONSOLE_LEVELS = [
 	"log",
 	"warn",
@@ -11126,6 +11178,31 @@ const ALL_CONSOLE_LEVELS = [
 	"debug",
 	"info"
 ];
+function getConsoleCapturePlugin(captureConsoleLogs, debugLogger) {
+	if (!captureConsoleLogs) return void 0;
+	const { levels = ALL_CONSOLE_LEVELS, sanitize } = captureConsoleLogs === true ? {} : captureConsoleLogs;
+	if (levels.length === 0) return void 0;
+	const plugin = getRecordConsolePlugin({ level: levels });
+	const sanitizeValue = getValueSanitizer(sanitize, "console");
+	if (!sanitizeValue) return plugin;
+	const observeConsole = plugin.observer;
+	if (!observeConsole) return void 0;
+	const warn = createOnceLogger(debugLogger);
+	return {
+		...plugin,
+		observer: (callback, win, observerOptions) => observeConsole((data) => {
+			const log = data;
+			const sanitized = dropOnFailure(() => ({
+				...log,
+				payload: log.payload.map(sanitizeValue),
+				trace: log.trace.map(sanitizeValue)
+			}), warn, "console");
+			if (sanitized) callback(sanitized);
+		}, win, observerOptions)
+	};
+}
+//#endregion
+//#region src/engine/rrweb-engine.ts
 const BLOCKED_ELEMENT_ATTRIBUTE = "data-csr-blocked-element";
 function labelBlockedElement(node, tracker, parentId) {
 	if (node.id !== void 0 && parentId !== void 0) {
@@ -11274,15 +11351,10 @@ var RrwebEngine = class {
 			clipboardActionsPlugin(),
 			blockedElementLabelsPlugin()
 		];
-		const { captureConsoleLogs } = config;
-		if (captureConsoleLogs) {
-			const levels = captureConsoleLogs === true ? ALL_CONSOLE_LEVELS : captureConsoleLogs.levels;
-			if (levels.length > 0) plugins.push(getRecordConsolePlugin({ level: levels }));
-		}
+		const consoleCapturePlugin = getConsoleCapturePlugin(config.captureConsoleLogs, config.debugLogger);
+		if (consoleCapturePlugin) plugins.push(consoleCapturePlugin);
 		this.stopFn = record$1({
-			emit: (event) => {
-				onEvent(event);
-			},
+			emit: onEvent,
 			maskAllInputs: config.maskInputs ?? true,
 			...maskSelectors.length ? { maskTextSelector: maskSelectors.join(",") } : {},
 			...blockSelectors.length ? { blockSelector: blockSelectors.join(",") } : {},

package/dist/index.d.cts

@@ -11,6 +11,10 @@ interface RecordingEngine {
   stop(): void;
 }
 //#endregion
+//#region src/capture-sanitizer.d.ts
+/** Capture option: `true` for the built-in policy, or a customer-defined function. */
+type CaptureSanitizer = boolean | ((value: string) => string);
+//#endregion
 //#region src/types.d.ts
 interface RecorderOptions {
   /** Engine used to capture DOM events (defaults to rrweb). */
@@ -20,6 +24,13 @@ interface RecorderOptions {
 }
 declare const DEFAULT_MASK_SELECTORS: string[];
 declare const DEFAULT_BLOCK_SELECTORS: string[];
+interface ConsoleCaptureOptions {
+  levels?: import("@spotify-confidence/csr-common").ConsoleLogLevel[];
+  sanitize?: CaptureSanitizer;
+}
+interface NetworkCaptureOptions {
+  sanitize?: CaptureSanitizer;
+}
 interface RecordingConfig {
   /**
   * CSS selectors for text content that should be masked. Joined with `,` and
@@ -50,10 +61,10 @@ interface RecordingConfig {
   *
   * - `true` — capture all levels (log, warn, error, debug, info).
   * - `{ levels: [...] }` — capture only the listed levels.
+  * - Add `sanitize: true` to remove query strings and fragments from URLs,
+  *   or provide a function to sanitize each captured payload and trace.
   */
-  captureConsoleLogs?: boolean | {
-    levels: import("@spotify-confidence/csr-common").ConsoleLogLevel[];
-  };
+  captureConsoleLogs?: boolean | ConsoleCaptureOptions;
   /**
   * Capture network requests (fetch and XMLHttpRequest) during the recording.
   * Defaults to `false` because request URLs and metadata can contain PII,
@@ -61,8 +72,14 @@ interface RecordingConfig {
   *
   * Only metadata is captured (method, URL, status, duration, sizes) — no
   * headers or bodies are recorded.
+  *
+  * - `true` — capture raw URLs, preserving existing behavior.
+  * - `{ sanitize: true }` — remove query strings and fragments.
+  * - `{ sanitize: value => ... }` — apply a custom sanitizer.
   */
-  captureNetworkRequests?: boolean;
+  captureNetworkRequests?: boolean | NetworkCaptureOptions;
+  /** Optional diagnostic logger used for fail-closed sanitizer warnings. */
+  debugLogger?: (message: string) => void;
   /**
   * Capture client-side route changes during the recording. Defaults to
   * `true`. Only the pathname is recorded; origin, query strings, and
@@ -111,6 +128,8 @@ declare class Recorder {
   private originalReplaceState;
   private popstateHandler;
   private parameterizeRoute;
+  private sanitizeNetworkUrl;
+  private warnNetworkDrop;
   constructor(options: RecorderOptions);
   get currentState(): RecorderState;
   start(config?: RecordingConfig): void;
@@ -150,4 +169,4 @@ declare function record(onEvent: (event: RecordingEvent) => void, config?: Recor
 //#region src/route-parameterizer.d.ts
 declare function defaultParameterizeRoute(route: string): string;
 //#endregion
-export { DEFAULT_BLOCK_SELECTORS, DEFAULT_MASK_SELECTORS, Recorder, type RecorderOptions, RecorderState, type RecordingConfig, type RecordingEngine, RrwebEngine, defaultParameterizeRoute, record };
+export { type CaptureSanitizer, type ConsoleCaptureOptions, DEFAULT_BLOCK_SELECTORS, DEFAULT_MASK_SELECTORS, type NetworkCaptureOptions, Recorder, type RecorderOptions, RecorderState, type RecordingConfig, type RecordingEngine, RrwebEngine, defaultParameterizeRoute, record };

package/dist/index.d.ts

@@ -11,6 +11,10 @@ interface RecordingEngine {
   stop(): void;
 }
 //#endregion
+//#region src/capture-sanitizer.d.ts
+/** Capture option: `true` for the built-in policy, or a customer-defined function. */
+type CaptureSanitizer = boolean | ((value: string) => string);
+//#endregion
 //#region src/types.d.ts
 interface RecorderOptions {
   /** Engine used to capture DOM events (defaults to rrweb). */
@@ -20,6 +24,13 @@ interface RecorderOptions {
 }
 declare const DEFAULT_MASK_SELECTORS: string[];
 declare const DEFAULT_BLOCK_SELECTORS: string[];
+interface ConsoleCaptureOptions {
+  levels?: import("@spotify-confidence/csr-common").ConsoleLogLevel[];
+  sanitize?: CaptureSanitizer;
+}
+interface NetworkCaptureOptions {
+  sanitize?: CaptureSanitizer;
+}
 interface RecordingConfig {
   /**
   * CSS selectors for text content that should be masked. Joined with `,` and
@@ -50,10 +61,10 @@ interface RecordingConfig {
   *
   * - `true` — capture all levels (log, warn, error, debug, info).
   * - `{ levels: [...] }` — capture only the listed levels.
+  * - Add `sanitize: true` to remove query strings and fragments from URLs,
+  *   or provide a function to sanitize each captured payload and trace.
   */
-  captureConsoleLogs?: boolean | {
-    levels: import("@spotify-confidence/csr-common").ConsoleLogLevel[];
-  };
+  captureConsoleLogs?: boolean | ConsoleCaptureOptions;
   /**
   * Capture network requests (fetch and XMLHttpRequest) during the recording.
   * Defaults to `false` because request URLs and metadata can contain PII,
@@ -61,8 +72,14 @@ interface RecordingConfig {
   *
   * Only metadata is captured (method, URL, status, duration, sizes) — no
   * headers or bodies are recorded.
+  *
+  * - `true` — capture raw URLs, preserving existing behavior.
+  * - `{ sanitize: true }` — remove query strings and fragments.
+  * - `{ sanitize: value => ... }` — apply a custom sanitizer.
   */
-  captureNetworkRequests?: boolean;
+  captureNetworkRequests?: boolean | NetworkCaptureOptions;
+  /** Optional diagnostic logger used for fail-closed sanitizer warnings. */
+  debugLogger?: (message: string) => void;
   /**
   * Capture client-side route changes during the recording. Defaults to
   * `true`. Only the pathname is recorded; origin, query strings, and
@@ -111,6 +128,8 @@ declare class Recorder {
   private originalReplaceState;
   private popstateHandler;
   private parameterizeRoute;
+  private sanitizeNetworkUrl;
+  private warnNetworkDrop;
   constructor(options: RecorderOptions);
   get currentState(): RecorderState;
   start(config?: RecordingConfig): void;
@@ -150,4 +169,4 @@ declare function record(onEvent: (event: RecordingEvent) => void, config?: Recor
 //#region src/route-parameterizer.d.ts
 declare function defaultParameterizeRoute(route: string): string;
 //#endregion
-export { DEFAULT_BLOCK_SELECTORS, DEFAULT_MASK_SELECTORS, Recorder, type RecorderOptions, RecorderState, type RecordingConfig, type RecordingEngine, RrwebEngine, defaultParameterizeRoute, record };
+export { type CaptureSanitizer, type ConsoleCaptureOptions, DEFAULT_BLOCK_SELECTORS, DEFAULT_MASK_SELECTORS, type NetworkCaptureOptions, Recorder, type RecorderOptions, RecorderState, type RecordingConfig, type RecordingEngine, RrwebEngine, defaultParameterizeRoute, record };

package/dist/index.js

@@ -63,6 +63,48 @@ function extractGraphQLRequestMetadata(url, body) {
 	return operationName ? { operationName } : void 0;
 }
 //#endregion
+//#region src/capture-sanitizer.ts
+const URL_IN_TEXT = /(?:(?:https?|wss?):)?\/\/[^\s<>"')\]}]+/giu;
+const RELATIVE_URL_IN_TEXT = /(^|[\s("'=])(\/(?!\/)[^\s<>"')\]}]*[?#][^\s<>"')\]}]*)/giu;
+/** Remove query strings and fragments from every URL found inside free text. */
+function stripUrlsInText(value) {
+	return value.replace(URL_IN_TEXT, stripUrlQueryAndHash).replace(RELATIVE_URL_IN_TEXT, (_match, prefix, url) => prefix + stripUrlQueryAndHash(url));
+}
+const BUILT_IN = {
+	network: stripUrlQueryAndHash,
+	console: stripUrlsInText
+};
+/** The sanitizer for one capture channel, or `undefined` when that channel stays raw. */
+function getValueSanitizer(sanitizer, source) {
+	if (!sanitizer) return void 0;
+	const sanitize = sanitizer === true ? BUILT_IN[source] : sanitizer;
+	return (value) => {
+		const sanitized = sanitize(value);
+		if (typeof sanitized !== "string") throw new TypeError("Sanitizer must return a string");
+		return sanitized;
+	};
+}
+/** Log at most once. Diagnostics must never reach the host application. */
+function createOnceLogger(debugLogger) {
+	let hasLogged = false;
+	return (message) => {
+		if (hasLogged) return;
+		hasLogged = true;
+		try {
+			debugLogger?.(message);
+		} catch (_error) {}
+	};
+}
+/** Build a captured event. Returns `undefined` when sanitizing threw, so the caller drops it. */
+function dropOnFailure(build, warn, source) {
+	try {
+		return build();
+	} catch (_error) {
+		warn(`SECURITY: ${source} sanitizer failed; captured event dropped`);
+		return;
+	}
+}
+//#endregion
 //#region src/recorder.ts
 var Recorder = class Recorder {
 	engine;
@@ -77,6 +119,8 @@ var Recorder = class Recorder {
 	originalReplaceState = null;
 	popstateHandler = null;
 	parameterizeRoute;
+	sanitizeNetworkUrl;
+	warnNetworkDrop = createOnceLogger();
 	constructor(options) {
 		this.engine = options.engine;
 		this.onEvent = options.onEvent;
@@ -88,6 +132,8 @@ var Recorder = class Recorder {
 		if (this.state === "recording") return;
 		this.state = "recording";
 		this.parameterizeRoute = config?.parameterizeRoute ?? defaultParameterizeRoute;
+		this.sanitizeNetworkUrl = getValueSanitizer(typeof config?.captureNetworkRequests === "object" ? config.captureNetworkRequests.sanitize : void 0, "network");
+		this.warnNetworkDrop = createOnceLogger(config?.debugLogger);
 		this.engine.start(config ?? {}, (event) => {
 			if (event.type === RecordingEventType.Meta) {
 				const data = event.data;
@@ -124,7 +170,13 @@ var Recorder = class Recorder {
 		if (config?.captureNetworkRequests) this.patchNetwork();
 		if (config?.captureRouteChanges !== false) this.patchRouting();
 	}
-	emitNetworkRequest(payload) {
+	emitNetworkRequest(raw) {
+		const sanitizeUrl = this.sanitizeNetworkUrl;
+		const payload = sanitizeUrl ? dropOnFailure(() => ({
+			...raw,
+			url: sanitizeUrl(raw.url)
+		}), this.warnNetworkDrop, "network") : raw;
+		if (!payload) return;
 		const data = {
 			plugin: RecordingPluginName.NetworkRequest,
 			payload
@@ -11117,7 +11169,7 @@ const getRecordConsolePlugin = (options) => ({
 	options
 });
 //#endregion
-//#region src/engine/rrweb-engine.ts
+//#region src/engine/console-capture-plugin.ts
 const ALL_CONSOLE_LEVELS = [
 	"log",
 	"warn",
@@ -11125,6 +11177,31 @@ const ALL_CONSOLE_LEVELS = [
 	"debug",
 	"info"
 ];
+function getConsoleCapturePlugin(captureConsoleLogs, debugLogger) {
+	if (!captureConsoleLogs) return void 0;
+	const { levels = ALL_CONSOLE_LEVELS, sanitize } = captureConsoleLogs === true ? {} : captureConsoleLogs;
+	if (levels.length === 0) return void 0;
+	const plugin = getRecordConsolePlugin({ level: levels });
+	const sanitizeValue = getValueSanitizer(sanitize, "console");
+	if (!sanitizeValue) return plugin;
+	const observeConsole = plugin.observer;
+	if (!observeConsole) return void 0;
+	const warn = createOnceLogger(debugLogger);
+	return {
+		...plugin,
+		observer: (callback, win, observerOptions) => observeConsole((data) => {
+			const log = data;
+			const sanitized = dropOnFailure(() => ({
+				...log,
+				payload: log.payload.map(sanitizeValue),
+				trace: log.trace.map(sanitizeValue)
+			}), warn, "console");
+			if (sanitized) callback(sanitized);
+		}, win, observerOptions)
+	};
+}
+//#endregion
+//#region src/engine/rrweb-engine.ts
 const BLOCKED_ELEMENT_ATTRIBUTE = "data-csr-blocked-element";
 function labelBlockedElement(node, tracker, parentId) {
 	if (node.id !== void 0 && parentId !== void 0) {
@@ -11273,15 +11350,10 @@ var RrwebEngine = class {
 			clipboardActionsPlugin(),
 			blockedElementLabelsPlugin()
 		];
-		const { captureConsoleLogs } = config;
-		if (captureConsoleLogs) {
-			const levels = captureConsoleLogs === true ? ALL_CONSOLE_LEVELS : captureConsoleLogs.levels;
-			if (levels.length > 0) plugins.push(getRecordConsolePlugin({ level: levels }));
-		}
+		const consoleCapturePlugin = getConsoleCapturePlugin(config.captureConsoleLogs, config.debugLogger);
+		if (consoleCapturePlugin) plugins.push(consoleCapturePlugin);
 		this.stopFn = record$1({
-			emit: (event) => {
-				onEvent(event);
-			},
+			emit: onEvent,
 			maskAllInputs: config.maskInputs ?? true,
 			...maskSelectors.length ? { maskTextSelector: maskSelectors.join(",") } : {},
 			...blockSelectors.length ? { blockSelector: blockSelectors.join(",") } : {},

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@spotify-confidence/csr-recorder",
   "license": "Apache-2.0",
-  "version": "0.17.21",
+  "version": "0.17.22",
   "repository": {
     "type": "git",
     "url": "https://github.com/spotify/confidence-sdk-js.git",

package/src/capture-sanitizer.ts

@@ -0,0 +1,67 @@
+import { stripUrlQueryAndHash } from '@spotify-confidence/csr-common';
+
+/** Capture option: `true` for the built-in policy, or a customer-defined function. */
+export type CaptureSanitizer = boolean | ((value: string) => string);
+
+/** Sanitizes one captured string. Throws when the policy fails, which drops the whole event. */
+export type ValueSanitizer = (value: string) => string;
+
+type CaptureSource = 'console' | 'network';
+
+const URL_IN_TEXT = /(?:(?:https?|wss?):)?\/\/[^\s<>"')\]}]+/giu;
+const RELATIVE_URL_IN_TEXT = /(^|[\s("'=])(\/(?!\/)[^\s<>"')\]}]*[?#][^\s<>"')\]}]*)/giu;
+
+/** Remove query strings and fragments from every URL found inside free text. */
+export function stripUrlsInText(value: string): string {
+  return value
+    .replace(URL_IN_TEXT, stripUrlQueryAndHash)
+    .replace(RELATIVE_URL_IN_TEXT, (_match, prefix: string, url: string) => prefix + stripUrlQueryAndHash(url));
+}
+
+const BUILT_IN: Record<CaptureSource, ValueSanitizer> = {
+  network: stripUrlQueryAndHash,
+  console: stripUrlsInText,
+};
+
+/** The sanitizer for one capture channel, or `undefined` when that channel stays raw. */
+export function getValueSanitizer(
+  sanitizer: CaptureSanitizer | undefined,
+  source: CaptureSource,
+): ValueSanitizer | undefined {
+  if (!sanitizer) return undefined;
+
+  const sanitize = sanitizer === true ? BUILT_IN[source] : sanitizer;
+  return value => {
+    const sanitized = sanitize(value);
+    if (typeof sanitized !== 'string') throw new TypeError('Sanitizer must return a string');
+    return sanitized;
+  };
+}
+
+/** Log at most once. Diagnostics must never reach the host application. */
+export function createOnceLogger(debugLogger?: (message: string) => void): (message: string) => void {
+  let hasLogged = false;
+  return message => {
+    if (hasLogged) return;
+    hasLogged = true;
+    try {
+      debugLogger?.(message);
+    } catch (_error) {
+      // Diagnostics must never affect the host application.
+    }
+  };
+}
+
+/** Build a captured event. Returns `undefined` when sanitizing threw, so the caller drops it. */
+export function dropOnFailure<T>(
+  build: () => T,
+  warn: (message: string) => void,
+  source: CaptureSource,
+): T | undefined {
+  try {
+    return build();
+  } catch (_error) {
+    warn(`SECURITY: ${source} sanitizer failed; captured event dropped`);
+    return undefined;
+  }
+}

package/src/engine/console-capture-plugin.ts

@@ -0,0 +1,45 @@
+import { getRecordConsolePlugin } from '@rrweb/rrweb-plugin-console-record';
+import type { ConsoleLogLevel, ConsoleLogPluginData } from '@spotify-confidence/csr-common';
+import { createOnceLogger, dropOnFailure, getValueSanitizer } from '../capture-sanitizer';
+import type { ConsoleCaptureOptions } from '../types';
+
+const ALL_CONSOLE_LEVELS: ConsoleLogLevel[] = ['log', 'warn', 'error', 'debug', 'info'];
+
+export function getConsoleCapturePlugin(
+  captureConsoleLogs: boolean | ConsoleCaptureOptions | undefined,
+  debugLogger?: (message: string) => void,
+): ReturnType<typeof getRecordConsolePlugin> | undefined {
+  if (!captureConsoleLogs) return undefined;
+
+  const options: ConsoleCaptureOptions = captureConsoleLogs === true ? {} : captureConsoleLogs;
+  const { levels = ALL_CONSOLE_LEVELS, sanitize } = options;
+  if (levels.length === 0) return undefined;
+
+  const plugin = getRecordConsolePlugin({ level: levels });
+  const sanitizeValue = getValueSanitizer(sanitize, 'console');
+  if (!sanitizeValue) return plugin;
+
+  const observeConsole = plugin.observer;
+  // Fail closed: with no observer to wrap there is no way to sanitize.
+  if (!observeConsole) return undefined;
+
+  const warn = createOnceLogger(debugLogger);
+  return {
+    ...plugin,
+    // Malformed plugin data also fails closed here: mapping a non-array throws.
+    observer: (callback, win, observerOptions) =>
+      observeConsole(
+        data => {
+          const log = data as ConsoleLogPluginData['payload'];
+          const sanitized = dropOnFailure(
+            () => ({ ...log, payload: log.payload.map(sanitizeValue), trace: log.trace.map(sanitizeValue) }),
+            warn,
+            'console',
+          );
+          if (sanitized) callback(sanitized);
+        },
+        win,
+        observerOptions,
+      ),
+  };
+}

package/src/engine/rrweb-engine.test.ts

@@ -6,6 +6,7 @@ import { RrwebEngine } from './rrweb-engine';
 
 const recordSpy = vi.fn().mockReturnValue(() => {});
 const takeFullSnapshotSpy = vi.fn();
+const consoleObserverSpy = vi.fn();
 
 vi.mock('rrweb', async importOriginal => ({
   ...(await importOriginal<typeof import('rrweb')>()),
@@ -13,6 +14,31 @@ vi.mock('rrweb', async importOriginal => ({
   takeFullSnapshot: (isCheckout: boolean) => takeFullSnapshotSpy(isCheckout),
 }));
 
+vi.mock('@rrweb/rrweb-plugin-console-record', () => ({
+  getRecordConsolePlugin: (options: unknown) => ({
+    name: 'rrweb/console@1',
+    options,
+    observer: (callback: (...args: unknown[]) => void) => {
+      consoleObserverSpy(callback);
+      return () => {};
+    },
+  }),
+}));
+
+function observeConsolePlugin(
+  captureConsoleLogs: NonNullable<Parameters<RrwebEngine['start']>[0]['captureConsoleLogs']>,
+  debugLogger?: (message: string) => void,
+) {
+  new RrwebEngine().start({ captureConsoleLogs, debugLogger }, () => {});
+  const plugin = recordSpy.mock.calls[0][0].plugins.find(
+    ({ name }: { name: string }) => name === RecordingPluginName.ConsoleLog,
+  );
+  const callback = vi.fn();
+  plugin.observer(callback, window, plugin.options);
+
+  return { callback, emitConsoleData: consoleObserverSpy.mock.calls[0][0] };
+}
+
 function blockedElementLabelsPlugin() {
   new RrwebEngine().start({}, () => {});
   return recordSpy.mock.calls[0][0].plugins.find(
@@ -63,6 +89,7 @@ describe('RrwebEngine', () => {
   beforeEach(() => {
     recordSpy.mockClear();
     takeFullSnapshotSpy.mockClear();
+    consoleObserverSpy.mockClear();
   });
 
   it('defaults maskAllInputs=true when maskInputs is omitted', () => {
@@ -256,6 +283,111 @@ describe('RrwebEngine', () => {
     expect(recordSpy.mock.calls[0][0].slimDOMOptions).toBe('all');
   });
 
+  it('strips query strings and fragments from console payloads and traces', () => {
+    const { callback, emitConsoleData } = observeConsolePlugin({ levels: ['error'], sanitize: true });
+
+    emitConsoleData({
+      level: 'error',
+      payload: [
+        'Stripe failed at https://api.stripe.com/intents/pi_1?client_secret=secret#result',
+        'socket wss://events.example/stream?subscriber=user-1 and //cdn.example/script.js?token=secret',
+      ],
+      trace: ['at checkout (/checkout?subscriber=user-1#payment:10:2)'],
+    });
+
+    expect(callback).toHaveBeenCalledWith({
+      level: 'error',
+      payload: [
+        'Stripe failed at https://api.stripe.com/intents/pi_1',
+        'socket wss://events.example/stream and //cdn.example/script.js',
+      ],
+      trace: ['at checkout (/checkout)'],
+    });
+  });
+
+  it('keeps raw console data when sanitization is not configured', () => {
+    const { callback, emitConsoleData } = observeConsolePlugin({ levels: ['error'] });
+    const data = {
+      level: 'error',
+      payload: ['https://api.example.com/payment?client_secret=secret'],
+      trace: [],
+    };
+
+    emitConsoleData(data);
+
+    expect(callback).toHaveBeenCalledWith(data);
+  });
+
+  it('uses a custom sanitizer for every console payload and trace string', () => {
+    const { callback, emitConsoleData } = observeConsolePlugin({
+      levels: ['error'],
+      sanitize: value => value.replaceAll('secret', '[REDACTED]'),
+    });
+
+    emitConsoleData({
+      level: 'error',
+      payload: ['secret'],
+      trace: ['secret trace'],
+    });
+
+    expect(callback).toHaveBeenCalledWith({
+      level: 'error',
+      payload: ['[REDACTED]'],
+      trace: ['[REDACTED] trace'],
+    });
+  });
+
+  it('drops console events and logs when a custom sanitizer throws', () => {
+    const debugLogger = vi.fn();
+    const { callback, emitConsoleData } = observeConsolePlugin(
+      {
+        levels: ['error'],
+        sanitize: () => {
+          throw new Error('sanitizer bug');
+        },
+      },
+      debugLogger,
+    );
+
+    emitConsoleData({
+      level: 'error',
+      payload: ['client_secret=secret', 'subscriber=user-1'],
+      trace: ['secret'],
+    });
+    emitConsoleData({ level: 'error', payload: ['another secret'], trace: [] });
+
+    expect(callback).not.toHaveBeenCalled();
+    expect(debugLogger).toHaveBeenCalledWith(expect.stringMatching(/SECURITY.*console.*dropped/i));
+    expect(debugLogger).toHaveBeenCalledTimes(1);
+    expect(debugLogger.mock.calls.join(' ')).not.toContain('client_secret=secret');
+  });
+
+  it('skips only the console events its sanitizer cannot handle and keeps capturing the rest', () => {
+    const { callback, emitConsoleData } = observeConsolePlugin({
+      levels: ['error'],
+      sanitize: value => {
+        if (value.includes('unhandled')) throw new Error('sanitizer bug');
+        return value.replaceAll('secret', '[REDACTED]');
+      },
+    });
+
+    emitConsoleData({ level: 'error', payload: ['unhandled secret'], trace: [] });
+    emitConsoleData({ level: 'error', payload: ['next secret'], trace: [] });
+
+    expect(callback).toHaveBeenCalledTimes(1);
+    expect(callback).toHaveBeenCalledWith({ level: 'error', payload: ['next [REDACTED]'], trace: [] });
+  });
+
+  it('fails closed on malformed console plugin data instead of asserting its type', () => {
+    const debugLogger = vi.fn();
+    const { callback, emitConsoleData } = observeConsolePlugin({ sanitize: true }, debugLogger);
+
+    emitConsoleData({ level: 'error', payload: 'not-an-array', trace: [] });
+
+    expect(callback).not.toHaveBeenCalled();
+    expect(debugLogger).toHaveBeenCalledWith(expect.stringMatching(/SECURITY.*console.*dropped/i));
+  });
+
   it('records copy, cut, and paste actions without reading clipboard contents', () => {
     new RrwebEngine().start({}, () => {});
     const plugin = recordSpy.mock.calls[0][0].plugins.find(

package/src/engine/rrweb-engine.ts

@@ -1,10 +1,8 @@
-import { RecordingPluginName, type ConsoleLogLevel, type RecordingEvent } from '@spotify-confidence/csr-common';
+import { RecordingPluginName, type RecordingEvent } from '@spotify-confidence/csr-common';
 import { RecordingConfig, DEFAULT_MASK_SELECTORS, DEFAULT_BLOCK_SELECTORS } from '../types';
 import { RecordingEngine } from './index';
 import { EventType, IncrementalSource, MouseInteractions, record, takeFullSnapshot, type recordOptions } from 'rrweb';
-import { getRecordConsolePlugin } from '@rrweb/rrweb-plugin-console-record';
-
-const ALL_CONSOLE_LEVELS: ConsoleLogLevel[] = ['log', 'warn', 'error', 'debug', 'info'];
+import { getConsoleCapturePlugin } from './console-capture-plugin';
 
 type RrwebPlugin = NonNullable<recordOptions<RecordingEvent>['plugins']>[number];
 
@@ -198,19 +196,12 @@ export class RrwebEngine implements RecordingEngine {
     const blockSelectors = config.blockSelectors ?? DEFAULT_BLOCK_SELECTORS;
 
     const plugins: RrwebPlugin[] = [clickModifiersPlugin(), clipboardActionsPlugin(), blockedElementLabelsPlugin()];
-    const { captureConsoleLogs } = config;
-    if (captureConsoleLogs) {
-      const levels = captureConsoleLogs === true ? ALL_CONSOLE_LEVELS : captureConsoleLogs.levels;
-      if (levels.length > 0) {
-        plugins.push(getRecordConsolePlugin({ level: levels }));
-      }
-    }
+    const consoleCapturePlugin = getConsoleCapturePlugin(config.captureConsoleLogs, config.debugLogger);
+    if (consoleCapturePlugin) plugins.push(consoleCapturePlugin);
 
     this.stopFn =
-      record({
-        emit: event => {
-          onEvent(event as unknown as RecordingEvent);
-        },
+      record<RecordingEvent>({
+        emit: onEvent,
         maskAllInputs: config.maskInputs ?? true,
         ...(maskSelectors.length ? { maskTextSelector: maskSelectors.join(',') } : {}),
         ...(blockSelectors.length ? { blockSelector: blockSelectors.join(',') } : {}),

package/src/index.ts

@@ -4,6 +4,9 @@ export { RrwebEngine } from './engine/rrweb-engine';
 export {
   type RecorderOptions,
   type RecordingConfig,
+  type CaptureSanitizer,
+  type ConsoleCaptureOptions,
+  type NetworkCaptureOptions,
   RecorderState,
   DEFAULT_MASK_SELECTORS,
   DEFAULT_BLOCK_SELECTORS,

package/src/recorder.test.ts

@@ -97,6 +97,7 @@ describe('Recorder network request capture', () => {
 
   afterEach(() => {
     globalThis.fetch = originalFetch;
+    vi.unstubAllGlobals();
   });
 
   it('does not patch fetch by default', () => {
@@ -151,6 +152,201 @@ describe('Recorder network request capture', () => {
     recorder.stop();
   });
 
+  it('keeps raw network URLs when sanitization is not configured', async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue(new Response('', { status: 200 }));
+
+    const onEvent = vi.fn();
+    const recorder = new Recorder({ engine: new MockEngine(), onEvent });
+    recorder.start({ captureNetworkRequests: true });
+
+    await globalThis.fetch('https://api.example.com/payment?client_secret=secret#result');
+
+    expect(networkRequestEvents(onEvent)[0].payload.url).toBe(
+      'https://api.example.com/payment?client_secret=secret#result',
+    );
+    recorder.stop();
+  });
+
+  it('strips query strings and fragments with built-in network sanitization', async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue(new Response('', { status: 200 }));
+
+    const onEvent = vi.fn();
+    const recorder = new Recorder({ engine: new MockEngine(), onEvent });
+    recorder.start({ captureNetworkRequests: { sanitize: true } });
+
+    await globalThis.fetch('https://api.example.com/payment?client_secret=secret#result');
+
+    expect(networkRequestEvents(onEvent)[0].payload.url).toBe('https://api.example.com/payment');
+    recorder.stop();
+  });
+
+  it('uses a custom network sanitizer', async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue(new Response('', { status: 200 }));
+
+    const onEvent = vi.fn();
+    const recorder = new Recorder({ engine: new MockEngine(), onEvent });
+    recorder.start({
+      captureNetworkRequests: {
+        sanitize: url => url.replace(/client_secret=[^&]+/, 'client_secret=[REDACTED]'),
+      },
+    });
+
+    await globalThis.fetch('https://api.example.com/payment?client_secret=secret&expand=customer');
+
+    expect(networkRequestEvents(onEvent)[0].payload.url).toBe(
+      'https://api.example.com/payment?client_secret=[REDACTED]&expand=customer',
+    );
+    recorder.stop();
+  });
+
+  it('sanitizes string, URL, and Request fetch inputs', async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue(new Response('', { status: 200 }));
+
+    const onEvent = vi.fn();
+    const recorder = new Recorder({ engine: new MockEngine(), onEvent });
+    recorder.start({ captureNetworkRequests: { sanitize: true } });
+
+    await globalThis.fetch('/relative?secret=one#hash');
+    await globalThis.fetch(new URL('https://api.example.com/url?secret=two#hash'));
+    await globalThis.fetch(new Request('https://api.example.com/request?secret=three#hash'));
+
+    expect(networkRequestEvents(onEvent).map(event => event.payload.url)).toEqual([
+      '/relative',
+      'https://api.example.com/url',
+      'https://api.example.com/request',
+    ]);
+    recorder.stop();
+  });
+
+  it('sanitizes XMLHttpRequest URLs without changing the request', () => {
+    class FakeXMLHttpRequest {
+      status = 204;
+      openedUrl: string | URL | undefined;
+      private loadend: (() => void) | undefined;
+
+      open(_method: string, url: string | URL) {
+        this.openedUrl = url;
+      }
+
+      send() {
+        this.loadend?.call(this);
+      }
+
+      addEventListener(_type: string, listener: () => void) {
+        this.loadend = listener;
+      }
+
+      getResponseHeader() {
+        return null;
+      }
+    }
+    vi.stubGlobal('XMLHttpRequest', FakeXMLHttpRequest);
+
+    const onEvent = vi.fn();
+    const recorder = new Recorder({ engine: new MockEngine(), onEvent });
+    recorder.start({ captureNetworkRequests: { sanitize: true } });
+    const xhr = new FakeXMLHttpRequest();
+
+    xhr.open('GET', 'https://api.example.com/payment?client_secret=secret#result');
+    xhr.send();
+
+    expect(xhr.openedUrl).toBe('https://api.example.com/payment?client_secret=secret#result');
+    expect(networkRequestEvents(onEvent)[0].payload).toMatchObject({
+      initiator: 'xhr',
+      url: 'https://api.example.com/payment',
+      status: 204,
+    });
+    recorder.stop();
+  });
+
+  it('drops network metadata and logs when a custom sanitizer throws', async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue(new Response('', { status: 200 }));
+
+    const onEvent = vi.fn();
+    const debugLogger = vi.fn();
+    const recorder = new Recorder({ engine: new MockEngine(), onEvent });
+    recorder.start({
+      captureNetworkRequests: {
+        sanitize: () => {
+          throw new Error('sanitizer bug');
+        },
+      },
+      debugLogger,
+    });
+
+    await expect(globalThis.fetch('https://api.example.com/payment?client_secret=secret')).resolves.toBeInstanceOf(
+      Response,
+    );
+    await globalThis.fetch('https://api.example.com/payment?client_secret=another-secret');
+
+    expect(networkRequestEvents(onEvent)).toHaveLength(0);
+    expect(debugLogger).toHaveBeenCalledWith(expect.stringMatching(/SECURITY.*network.*dropped/i));
+    expect(debugLogger).toHaveBeenCalledTimes(1);
+    expect(debugLogger.mock.calls.join(' ')).not.toContain('client_secret=secret');
+    recorder.stop();
+  });
+
+  it('keeps sanitizing a request that is still in flight when the recorder stops', async () => {
+    let settleFetch: (response: Response) => void = () => {};
+    globalThis.fetch = vi.fn().mockReturnValue(new Promise<Response>(resolve => (settleFetch = resolve)));
+
+    const onEvent = vi.fn();
+    const recorder = new Recorder({ engine: new MockEngine(), onEvent });
+    recorder.start({ captureNetworkRequests: { sanitize: true } });
+
+    // `stop()` cannot cancel an in-flight request, so its patched handler still emits.
+    const inFlight = globalThis.fetch('https://api.example.com/payment?client_secret=secret');
+    recorder.stop();
+    settleFetch(new Response('', { status: 200 }));
+    await inFlight;
+
+    expect(networkRequestEvents(onEvent)[0].payload.url).toBe('https://api.example.com/payment');
+  });
+
+  it('skips only the requests its sanitizer cannot handle and keeps capturing the rest', async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue(new Response('', { status: 200 }));
+
+    const onEvent = vi.fn();
+    const recorder = new Recorder({ engine: new MockEngine(), onEvent });
+    recorder.start({
+      captureNetworkRequests: {
+        sanitize: url => {
+          if (url.includes('/unhandled')) throw new Error('sanitizer bug');
+          return url.split('?')[0];
+        },
+      },
+    });
+
+    await globalThis.fetch('https://api.example.com/unhandled?client_secret=secret');
+    await globalThis.fetch('https://api.example.com/next?client_secret=secret');
+
+    expect(networkRequestEvents(onEvent).map(event => event.payload.url)).toEqual(['https://api.example.com/next']);
+    recorder.stop();
+  });
+
+  it('does not let a failing debug logger affect the application request', async () => {
+    globalThis.fetch = vi.fn().mockResolvedValue(new Response('', { status: 200 }));
+
+    const onEvent = vi.fn();
+    const recorder = new Recorder({ engine: new MockEngine(), onEvent });
+    recorder.start({
+      captureNetworkRequests: {
+        sanitize: () => {
+          throw new Error('sanitizer bug');
+        },
+      },
+      debugLogger: () => {
+        throw new Error('logger bug');
+      },
+    });
+
+    await expect(globalThis.fetch('https://api.example.com/payment?client_secret=secret')).resolves.toBeInstanceOf(
+      Response,
+    );
+    expect(networkRequestEvents(onEvent)).toHaveLength(0);
+    recorder.stop();
+  });
+
   it('emits status 0 for a failed fetch', async () => {
     globalThis.fetch = vi.fn().mockRejectedValue(new TypeError('Network error'));
 

package/src/recorder.ts

@@ -12,6 +12,7 @@ import { RecorderOptions, RecorderState, RecordingConfig } from './types';
 import { RecordingEngine } from './engine';
 import { defaultParameterizeRoute } from './route-parameterizer';
 import { extractGraphQLRequestMetadata } from './graphql-request';
+import { createOnceLogger, dropOnFailure, getValueSanitizer, type ValueSanitizer } from './capture-sanitizer';
 
 export class Recorder {
   private readonly engine: RecordingEngine;
@@ -26,6 +27,8 @@ export class Recorder {
   private originalReplaceState: typeof history.replaceState | null = null;
   private popstateHandler: (() => void) | null = null;
   private parameterizeRoute!: (route: string) => string;
+  private sanitizeNetworkUrl: ValueSanitizer | undefined;
+  private warnNetworkDrop = createOnceLogger();
 
   constructor(options: RecorderOptions) {
     this.engine = options.engine;
@@ -42,6 +45,11 @@ export class Recorder {
     }
     this.state = RecorderState.Recording;
     this.parameterizeRoute = config?.parameterizeRoute ?? defaultParameterizeRoute;
+    this.sanitizeNetworkUrl = getValueSanitizer(
+      typeof config?.captureNetworkRequests === 'object' ? config.captureNetworkRequests.sanitize : undefined,
+      'network',
+    );
+    this.warnNetworkDrop = createOnceLogger(config?.debugLogger);
 
     this.engine.start(config ?? {}, event => {
       if (event.type === RecordingEventType.Meta) {
@@ -86,7 +94,13 @@ export class Recorder {
     }
   }
 
-  private emitNetworkRequest(payload: NetworkRequestPluginData['payload']): void {
+  private emitNetworkRequest(raw: NetworkRequestPluginData['payload']): void {
+    const sanitizeUrl = this.sanitizeNetworkUrl;
+    const payload = sanitizeUrl
+      ? dropOnFailure(() => ({ ...raw, url: sanitizeUrl(raw.url) }), this.warnNetworkDrop, 'network')
+      : raw;
+    if (!payload) return;
+
     const data: NetworkRequestPluginData = {
       plugin: RecordingPluginName.NetworkRequest,
       payload,
@@ -304,6 +318,15 @@ export class Recorder {
       window.removeEventListener('pageshow', this.pageShowHandler);
       this.pageShowHandler = null;
     }
+    // The sanitizer is deliberately left in place. `restoreNetwork` cannot cancel
+    // in-flight requests, and their patched handlers still emit after `stop()`.
+    // Clearing it here would send those URLs raw.
+    // The sanitizer is deliberately left in place. `restoreNetwork` cannot cancel
+    // in-flight requests, and their patched handlers still emit after `stop()`.
+    // Clearing it here would send those URLs raw.
+    // The sanitizer is deliberately left in place. `restoreNetwork` cannot cancel
+    // in-flight requests, and their patched handlers still emit after `stop()`.
+    // Clearing it here would send those URLs raw.
     this.restoreNetwork();
     this.restoreRouting();
     this.engine.stop();

package/src/types.ts

@@ -1,3 +1,5 @@
+import type { CaptureSanitizer } from './capture-sanitizer';
+
 export interface RecorderOptions {
   /** Engine used to capture DOM events (defaults to rrweb). */
   engine: import('./engine').RecordingEngine;
@@ -8,6 +10,17 @@ export interface RecorderOptions {
 export const DEFAULT_MASK_SELECTORS: string[] = ['[data-csr-mask]'];
 export const DEFAULT_BLOCK_SELECTORS: string[] = ['[data-csr-block]', 'video'];
 
+export type { CaptureSanitizer };
+
+export interface ConsoleCaptureOptions {
+  levels?: import('@spotify-confidence/csr-common').ConsoleLogLevel[];
+  sanitize?: CaptureSanitizer;
+}
+
+export interface NetworkCaptureOptions {
+  sanitize?: CaptureSanitizer;
+}
+
 export interface RecordingConfig {
   /**
    * CSS selectors for text content that should be masked. Joined with `,` and
@@ -38,8 +51,10 @@ export interface RecordingConfig {
    *
    * - `true` — capture all levels (log, warn, error, debug, info).
    * - `{ levels: [...] }` — capture only the listed levels.
+   * - Add `sanitize: true` to remove query strings and fragments from URLs,
+   *   or provide a function to sanitize each captured payload and trace.
    */
-  captureConsoleLogs?: boolean | { levels: import('@spotify-confidence/csr-common').ConsoleLogLevel[] };
+  captureConsoleLogs?: boolean | ConsoleCaptureOptions;
   /**
    * Capture network requests (fetch and XMLHttpRequest) during the recording.
    * Defaults to `false` because request URLs and metadata can contain PII,
@@ -47,8 +62,14 @@ export interface RecordingConfig {
    *
    * Only metadata is captured (method, URL, status, duration, sizes) — no
    * headers or bodies are recorded.
+   *
+   * - `true` — capture raw URLs, preserving existing behavior.
+   * - `{ sanitize: true }` — remove query strings and fragments.
+   * - `{ sanitize: value => ... }` — apply a custom sanitizer.
    */
-  captureNetworkRequests?: boolean;
+  captureNetworkRequests?: boolean | NetworkCaptureOptions;
+  /** Optional diagnostic logger used for fail-closed sanitizer warnings. */
+  debugLogger?: (message: string) => void;
   /**
    * Capture client-side route changes during the recording. Defaults to
    * `true`. Only the pathname is recorded; origin, query strings, and