[turnipdabeets]

Important

Hold until posthog-android#910/#912 are approved; they must ship in the same release.

Summary

Android apps set FLAG_SECURE on screens that must never be screenshotted (login, payment, PIN). session-replay-privacy didn't cover it, and Android session replay recorded those windows anyway: screenshot mode copied their pixels, wireframe mode serialized their view tree and text, and taps were recorded. Other parts of posthog-android already skip secure windows.

Changes

New requirement Android secure windows are recorded fully masked in session-replay-privacy:

• While the captured window has FLAG_SECURE, replay records it fully masked rather than skipping it, in every replay mode, so recordings show something private was there instead of freezing on the previous screen.
  • Screenshot mode: an opaque masked frame the size of the window; none of its pixels are recorded or uploaded.
  • Wireframe mode: one masked node covering the window, with no child views, text or images.
• The secure state is checked when capture starts and again before the frame is recorded; the frame is masked if the window was secure at either point.
• Taps on a secure window aren't recorded; the app still receives them.
• Each window follows its own flag, so a dialog without the flag over a secure activity is captured normally, as Android's own screenshots do.
• Not applicable on iOS, which has no window-level secure flag and keeps masking sensitive inputs per field.

openspec validate --specs --strict passes (68/68). No Gherkin added to acceptance/private/session-replay-privacy.feature, matching the neighbouring browser network requirement, which added none either.

Impact

• posthog-android: fix(replay): mask FLAG_SECURE windows and discard frames with unplaceable masked views posthog-android#910 (screenshot mode, taps, re-check before recording) and fix(replay): honour FLAG_SECURE in wireframe mode posthog-android#912 (wireframe mode, taps in every mode), both on main (3.x).
• posthog-flutter: renders its own Android frames, so it implements the screenshot behaviour itself in fix(android): mask session replay frames on FLAG_SECURE windows posthog-flutter#685; taps and native-screen captures come from posthog-android.
• posthog-react-native: Android replay runs through posthog-android; picks this up via the version bump in fix(react-native-plugin): require posthog-android 3.73.2 posthog-js#5483.
• posthog-ios, posthog-js (browser), server SDKs: not applicable.

🤖 Generated with Claude Code