Playground / Category C

C2 · Sensitive-field redaction

Password, phone, and credit-card inputs are auto-masked before they hit storage.

Live fixture · interact with it while the recorder is runningOpen in new tab ↗

Try this

Fill in your email, password, phone, card number, and CVC.
Only the email should round-trip in cleartext.

Why this is hard

Cross-origin iframe injection means recording can technically see payment-card fields. The recorder detects them by type / autocomplete / name and redacts the value to `***` with `masked: true` — bytes never leave the page.

Expected recorder output

[
  {
    "type": "change",
    "selectors": [
      "[data-testid=\"email\"]"
    ],
    "value": "<cleartext>"
  },
  {
    "type": "change",
    "selectors": [
      "[data-testid=\"pw\"]"
    ],
    "masked": true,
    "value": "***"
  },
  {
    "type": "change",
    "selectors": [
      "[data-testid=\"phone\"]"
    ],
    "masked": true
  },
  {
    "type": "change",
    "selectors": [
      "[data-testid=\"cc\"]"
    ],
    "masked": true
  },
  {
    "type": "change",
    "selectors": [
      "[data-testid=\"cvc\"]"
    ],
    "masked": true
  }
]