[turnipdabeets]

Important

Hold until posthog-android#910/#912 are approved; they must ship in the same release.

Summary

Android apps set FLAG_SECURE on screens that must never be screenshotted (login, payment, PIN). session-replay-privacy didn't cover it, and Android session replay recorded those windows anyway: screenshot mode copied their pixels, wireframe mode serialized their view tree and text, and taps were recorded. Other parts of posthog-android already skip secure windows.

Changes

New requirement Android secure windows are recorded fully masked in session-replay-privacy:

• While the captured window has FLAG_SECURE, replay records it fully masked rather than skipping it, in every replay mode, so recordings show something private was there instead of freezing on the previous screen.
  • Screenshot mode: an opaque, solid black frame the size of the window; none of its pixels are recorded or uploaded.
  • Wireframe mode: one solid black masked node covering the window, with no child views, text or images.
• The secure state is checked when capture starts and again before the frame is recorded; the frame is masked if the window was secure at either point.
• Taps on a secure window aren't recorded; the app still receives them.
• Each window follows its own flag, so a dialog without the flag over a secure activity is captured normally, as Android's own screenshots do.
• Not applicable on iOS, which has no window-level secure flag and keeps masking sensitive inputs per field.

openspec validate --specs --strict passes (68/68). No Gherkin added to acceptance/private/session-replay-privacy.feature, matching the neighbouring browser network requirement, which added none either.

Impact

• posthog-android: fix(replay): mask FLAG_SECURE windows and discard frames with unplaceable masked views posthog-android#910 (screenshot mode, taps, re-check before recording) and fix(replay): honour FLAG_SECURE in wireframe mode posthog-android#912 (wireframe mode, taps in every mode), both on main (3.x).
• posthog-flutter: renders its own Android frames, so it implements the screenshot behaviour itself in fix(android): mask session replay frames on FLAG_SECURE windows posthog-flutter#685; taps and native-screen captures come from posthog-android.
• posthog-react-native: Android replay runs through posthog-android; picks this up via the version bump in fix(react-native-plugin): require posthog-android 3.73.2 posthog-js#5483.
• posthog-kmp: Android replay runs through posthog-android; picks this up when its pinned version (3.72.9) is bumped to a release that includes it.
• posthog-unity: captures its own frames and has no FLAG_SECURE handling, so it's in scope but doesn't conform yet. Implementing this is a follow-up.
• posthog-ios, posthog-js (browser), server SDKs: not applicable.

🤖 Generated with Claude Code

[ioannisj]

🤖 An AI agent wrote this on behalf of @ioannisj.

Nothing here blocks the merge once posthog-android #910 and #912 land, which the description already holds for. The two inline comments are wording gaps that would let a conforming SDK differ from what android and flutter ship, worth closing while the change is still open.