DOM-capture recorder: redact secrets and PII at capture time

[rosscado]

Problem: recorded DOM fixtures (scripts/dom-capture/recorder.js output and manual captures under doc/dom/) have historically embedded live session tokens, emails, and account/org/device ids verbatim — PR #541 had to scrub three ChatGPT fixtures after the fact, and the #547 secret-scan baseline needed a rule-scoped allowlist for that directory.

Scope: the capture path (recorder + any documented manual capture recipe). Out of scope: the already-scrubbed historical fixtures, the CI scan itself (#531).

Reproduction / verification: capture any authenticated host page today → tokens/emails/user-org-device ids land in the artifact verbatim. Verify done = a fresh capture of an authenticated page contains only redacted placeholders (fake alg:none JWTs, redacted@example.com, user-REDACTED etc.), and the doc/dom capture recipe documents the guarantee.

Acceptance criteria:

• Capture-time redaction covers: JWT-shaped strings, email addresses, user-/org- account ids, device UUIDs (the classes found in the chore(hygiene): untrack local tunnel config; scrub tokens from recorded fixtures #541 scrub).
• The redaction is on by default; opting out requires an explicit flag documented as never-commit.
• The safety: secret scanning in CI — gitleaks with clean baseline (#531) #547 .gitleaks.toml fixture allowlist entry can be narrowed or removed once fixtures are guaranteed clean at capture.

Notes (non-binding): flagged by the #541 review and #547 review (nit 1) — this issue makes the follow-up tracked rather than a doc paragraph.

[umudhasanli]

Capture-time is the right boundary here. One practical option is to run the serialized DOM through Flare Redact before the recorder writes it:

import { redact } from "flare-redact";

const safeCapture = redact(serializedDom, {
  enable: ["phone"],
  custom: [accountIdDetector, orgIdDetector, deviceIdDetector],
});

JWTs and emails are covered by default. Project-specific user/org/device identifiers are better expressed as tight custom detectors instead of treating every UUID as sensitive, since blanket UUID masking would corrupt many legitimate DOM fixtures. The custom detectors can emit the exact placeholders required by the fixture contract.

I would also make the unsafe opt-out print a clear never-commit warning and keep one end-to-end test that captures an authenticated synthetic page.

Maintainer disclosure: I maintain Flare Redact.