Privacy & consent
Gate all capture behind user consent, respect GPC and Do-Not-Track, and configure a Content-Security-Policy that lets the SDK load and send without unsafe-eval.
Consent gating#
With requireConsent: true, no feature is set up and nothing is sent until you
grant consent — typically from your consent-management platform callback.
await ScaleBun.init({ clientKey, apiBaseUrl, requireConsent: true });
// later, from your CMP:ScaleBun.setConsent(true); // start capturing// ScaleBun.setConsent(false); // tears features down and discards buffered datasetConsent() is safe to call before init(), so you can record a decision
early and let init() honor it.
GPC and Do-Not-Track#
Set privacy.respectDnt to honor the browser's Global Privacy Control
(navigator.globalPrivacyControl) and Do-Not-Track signals — when the user has
opted out at the browser level, the SDK stays quiet.
Masking controls#
| Option | Default | What it covers |
|---|---|---|
maskReplayText | false | All static text in session replay. |
maskInputs | follows maskReplayText | Typed input values in replay. Passwords are always blanked regardless. |
maskEventText | false | The text label on interaction events — USER_ACTION.label and $autocapture props.text. |
maskSelectors | [] | Extra CSS selectors whose subtree text is always masked. |
captureNetworkBodies | false | Request and response bodies. |
denylist | built-ins + yours | Header and body keys stripped before send. |
respectDnt | false | Skip replay for users signalling GPC / Do-Not-Track. |
denylist is merged, never replaced — you can add keys, but you cannot
remove authorization, cookie, set-cookie, x-api-key, x-csrf-token,
password, token or secret.
Set maskInputs explicitly to decouple typed values from static text; left
alone, one flag governs both.
Any element can be masked directly with data-scalebun-mask, and
contenteditable regions are always masked.
Content-Security-Policy#
The SDK never uses unsafe-eval. For a strict CSP you need:
script-src— allow the CDN origin (only for the<script>/ GTM installs).connect-src— allow your ingestion API base URL.
Injected <style> blocks carry a nonce, auto-detected from the SDK's own
<script nonce> on CDN installs, or use constructable stylesheets. You can also
pass one explicitly:
await ScaleBun.init({ clientKey, apiBaseUrl, csp: { nonce: 'abc123' } });Next#
Install & initialize — delivery paths and CSP context.
Session replay — masking and canvas capture.