Redact Secrets from Playwright HAR and Trace Evidence

Playwright HAR trace secret redaction starts by preventing unnecessary capture, then scanning and governing every retained artifact before upload. Playwright offers capture-minimization controls, but no universal arbitrary-value redaction API for all HAR and trace data. Use synthetic accounts, narrow recording scope, policy-specific structured sanitization, quarantine, and fail-closed publication rules.

The absence of a universal API matters because secrets can appear in headers, URLs, bodies, cookies, DOM snapshots, screenshots, source files, socket frames, attachments, and logs. A safe Playwright evidence pipeline treats them as one evidence set. Review generated collectors with the AI-generated test evidence checklist before they become shared fixtures.

Define the Evidence and Threat Boundary

Start with the decision the artifact must support. A failed checkout may need the target request method, status, safe correlation ID, and UI chronology. It rarely needs every cookie, response body, analytics call, screenshot, source file, and console message from the entire authenticated session.

Inventory each output channel:

• HAR files and attached response resources.
• trace archives, DOM snapshots, screenshots, and included source files.
• video, ordinary screenshots, reporter attachments, and console output.
• WebSocket frame summaries and proxy logs.
• test-run metadata, stack traces, and application logs linked from CI.

Then identify secret classes rather than only known values. Include authorization and cookie headers, signed query parameters, passwords, API keys, session identifiers, client-certificate paths or contents, personal data, internal hostnames, and regulated business fields. Add synthetic canaries for high-risk classes so the scanner itself can be tested without using a real credential.

Define trust zones. Raw files should remain in a test-owned quarantine that ordinary report viewers cannot access. Sanitized derivatives may move to the CI artifact store only after scanning. Public build summaries should contain policy decisions and safe identifiers, not raw transport data.

The HAR network mocking guide explains why a recording can become a long-lived fixture. That makes review especially important: a committed HAR can expose data to every clone and cache, while a short-lived CI artifact still reaches reporters, storage, notifications, and support tooling.

Never make "retain on failure" the whole policy. A failed login or payment case can contain more sensitive detail than a pass. Artifact safety is an independent gate that runs before publication for every terminal test state.

Understand What Playwright Can Minimize

The Playwright release notes describe first-class HAR recording through tracing.startHar() and stopHar() from version 1.60. The installed 1.61.1 API supplies useful minimization controls:

• Start and stop around one action instead of recording the whole context lifetime.
• Use urlFilter to retain only matching requests.
• Use content: 'omit' when persisted content text and attached resources are unnecessary, then inspect body-derived fields separately.
• Use mode: 'minimal' when the file exists for HAR routing rather than full diagnosis.
• Choose attached or embedded content deliberately when content must be retained.

The Tracing API separately supports temporal scope plus screenshots, snapshots, and sources choices. DOM snapshots and network activity are tied to trace snapshots. Disabling them reduces exposure but also removes diagnostic features. Context-level tracing does not include Playwright Test assertions in the same way as runner-configured traces, so document the evidence tradeoff.

These are capture controls, not arbitrary redaction. Playwright does not accept a general callback such as "replace every secret value wherever it appears" for HAR and trace output. content: 'omit' does not remove all headers, URLs, or body-derived form parameters. Minimal mode is designed around replay needs, not an organization's data-classification rules. Disabling screenshots does not sanitize DOM snapshots, and disabling snapshots does not sanitize another attachment.

Do not confuse request mutation with artifact redaction. Removing an Authorization header in page.route() changes what the server receives and can invalidate the scenario. Replacing a response body before the page sees it tests different product behavior. Observation must not silently alter the boundary it claims to verify.

Use Playwright CLI trace analysis only on artifacts already permitted for the operator and environment. Opening a trace in another tool or browser expands access; it does not make the trace safer.

Build a Minimized Capture Window

Perform authentication and broad setup before recording whenever those phases are not the subject. Start the HAR only when the page is in a stable, synthetic state and stop it immediately after the target response and UI outcome. Configure Playwright Test tracing separately so the runner owns its lifecycle.

Example 1: Minimize HAR capture around one action

import { expect, test } from '@playwright/test';

test('captures a reduced-content order failure window', async ({ context, page }, testInfo) => {
  await page.goto('/cart');
  await expect(page.getByRole('heading', { name: 'Your cart' })).toBeVisible();

  const harPath = testInfo.outputPath('quarantine', 'order.har');
  await context.tracing.startHar(harPath, {
    urlFilter: /\/api\/orders(?:\/|\?|$)/,
    content: 'omit',
    mode: 'minimal',
  });

  try {
    const responsePromise = page.waitForResponse(response =>
      response.request().method() === 'POST' &&
      new URL(response.url()).pathname === '/api/orders',
    );

    await page.getByRole('button', { name: 'Place order' }).click();
    const response = await responsePromise;

    expect(response.status()).toBe(422);
    await expect(page.getByRole('alert')).toHaveText('Delivery address is required');
  } finally {
    await context.tracing.stopHar();
  }
});

The HAR remains under a directory named quarantine and is not attached automatically. A later policy stage decides whether an approved derivative is publishable. This is important because even a HAR without content text or attached resources can include a sensitive path, header, or structured form parameter.

The finally block attempts HAR finalization after a product assertion fails. A framework helper should preserve the original test error and report cleanup failures separately, but it must not upload a partially written file.

Do not call context.tracing.start() in the same test when the Playwright Test project already uses runner tracing such as trace: 'on-first-retry'; the two lifecycle owners conflict. Set runner trace capture options in a dedicated project and let the runner finalize its artifact after teardown. If a low-level manual trace is genuinely required, run that example in a project with runner tracing disabled. In either case, keep trace publication behind its own scan because snapshots, screenshots, action parameters, and network data have a different exposure surface from the filtered HAR.

Direct API setup should also use a limited account and safe payload. The Playwright API testing guide covers isolated request contexts and fixture ownership. Never create real customer data merely because the browser phase starts after setup.

Create a Policy-Specific HAR Sanitizer

When a diagnostic HAR must retain metadata, sanitize it as parsed JSON. Use the URL API for query handling and structured header or cookie arrays for values. A regular expression over the whole file can miss encodings, alter unrelated text, or produce invalid JSON.

No finite denylist catches every arbitrary secret. Combine known sensitive names, test canaries, an allowlist of hosts and paths, body removal, and human review for new fixture classes. The sanitizer below is intentionally policy-specific and should be adapted to an owned data classification.

Example 2: Redact selected HAR fields as structured data

import { readFile, writeFile } from 'node:fs/promises';

type HarHeader = { name: string; value: string };
type HarCookie = { name: string; value: string };
type HarEntry = {
  request: {
    url: string;
    headers?: HarHeader[];
    cookies?: HarCookie[];
    postData?: unknown;
  };
  response: {
    headers?: HarHeader[];
    cookies?: HarCookie[];
    content?: { text?: string; encoding?: string };
  };
};

const secretNames = new Set([
  'authorization',
  'cookie',
  'set-cookie',
  'x-api-key',
  'x-csrf-token',
]);

const secretQueryKeys = new Set([
  'access_token',
  'code',
  'key',
  'signature',
  'token',
]);

function sanitizeHeaders(headers: HarHeader[] = []): HarHeader[] {
  return headers.map(header => ({
    ...header,
    value: secretNames.has(header.name.toLowerCase())
      ? '[REDACTED]'
      : header.value,
  }));
}

function sanitizeUrl(rawUrl: string): string {
  const url = new URL(rawUrl);
  for (const key of [...url.searchParams.keys()]) {
    if (secretQueryKeys.has(key.toLowerCase()))
      url.searchParams.set(key, '[REDACTED]');
  }
  return url.toString();
}

export async function sanitizeHar(input: string, output: string): Promise<void> {
  const document = JSON.parse(await readFile(input, 'utf8')) as {
    log: { entries: HarEntry[] };
  };

  for (const entry of document.log.entries) {
    entry.request.url = sanitizeUrl(entry.request.url);
    entry.request.headers = sanitizeHeaders(entry.request.headers);
    entry.request.cookies = (entry.request.cookies ?? []).map(cookie => ({
      ...cookie,
      value: '[REDACTED]',
    }));
    delete entry.request.postData;

    entry.response.headers = sanitizeHeaders(entry.response.headers);
    entry.response.cookies = (entry.response.cookies ?? []).map(cookie => ({
      ...cookie,
      value: '[REDACTED]',
    }));
    if (entry.response.content) {
      delete entry.response.content.text;
      delete entry.response.content.encoding;
    }
  }

  await writeFile(output, JSON.stringify(document, null, 2), 'utf8');
}

Write the sanitized result to a new path. Do not overwrite the raw file before scanning can confirm which policy fired, and never publish the raw path. After policy checks, delete or expire the quarantine copy according to incident and retention rules.

This code removes request bodies and response text, redacts all cookie values, and replaces selected header and query values. It does not inspect path segments, arbitrary safe-looking headers, encoded values, binary attachments, or data copied into other artifacts. That incompleteness is why the pipeline needs allowlists, canaries, scanners, and controlled source data.

If the HAR is a replay fixture, sanitization can break request matching. Playwright uses URL, method, POST data, and in some cases header similarity to select entries. Rerun the HAR mocking workflow from a clean checkout and verify expected unmatched requests fail rather than falling through to a live service.

Govern Trace Evidence Without Unsafe ZIP Rewrites

A trace archive is designed for Playwright Trace Viewer, not as a general-purpose redaction document. It can contain related resources that must remain internally consistent. Editing arbitrary ZIP members can leave duplicate values, break references, or create a file that opens partially and hides missing evidence.

Prefer prevention:

1. Use synthetic identities and records before the test begins.
2. Start tracing after authentication if login is outside the decision.
3. Disable screenshots when pixels are unnecessary.
4. Disable snapshots when DOM and network capture are unnecessary.
5. Disable sources when source inclusion has no diagnostic value.
6. Stop immediately after the target assertion boundary.
7. Scan the finalized archive before any attachment or upload.

If a trace fails scanning, quarantine or discard it. Generate a safe structured summary from separately collected allowed fields rather than attempting an unsupported universal rewrite. Preserve the test result and policy failure even when the raw trace cannot leave the worker.

Screenshots need visual review or purpose-built detection because text scanners do not see pixels. DOM snapshots can include hidden values and application state that never appeared in a screenshot. Source files can include test constants or accidentally committed credentials. Treat each channel according to its format.

The official network guide shows request, response, and WebSocket observation surfaces. Those are helpful for filtered summaries, but listeners must avoid logging whole objects. Record methods, normalized paths, safe status values, and known message types rather than raw headers and payloads.

Current Playwright releases include WebSocket requests in HAR and trace recordings. Message-level collection through Playwright WebSocket mocking can expose additional frame content. Apply a protocol-specific allowlist and never assume a connection URL or frame is safe because it is not an HTTP body.

Design Secret-Leak and Boundary Tests

Test the evidence policy with synthetic canaries placed in every supported channel. A scanner that has never caught a controlled secret is only an assumption. Keep canaries obviously non-production and unique to the test attempt.

Run positive controls too. A safe status code, synthetic record ID, and required route should remain available after sanitization. An overbroad sanitizer that removes every useful correlation field produces a safe but operationally empty artifact.

Test archive finalization failures, scanner crashes, invalid JSON, oversized files, and missing policy configuration. Each must fail closed. A scanner timeout must not be interpreted as "no secret found."

Use a numbered end-to-end sequence for every artifact class:

1. Create controlled data and register observation before the trigger.
2. Capture the smallest window and format required by the decision.
3. Finalize files completely inside a restricted quarantine.
4. Parse or inspect each format with the approved policy tools.
5. Generate the smallest safe derivative and scan it again.
6. Publish only after all required checks return a positive approval.
7. Expire quarantine and published artifacts under separate retention rules.

Compare Minimization, Sanitization, and Scanning

These controls complement one another. Treating one as complete creates predictable gaps.

Minimize first because data never captured cannot leak from that artifact. Sanitize known structured fields second. Scan both raw quarantine and derivative where policy permits scanning. Use human review for new evidence classes and high-risk failures.

Do not call encryption redaction. Encryption protects stored or transferred bytes from unauthorized readers, but approved readers can still see every secret. Use encryption, access control, and audit logs in addition to minimizing and sanitizing content.

Do not call short retention redaction either. A credential exposed for five minutes can still be copied into notifications or logs. Rotation may be required even if the artifact was deleted quickly.

Protect Authentication and Tenant Boundaries

Use dedicated test accounts with minimal privileges and synthetic tenant data. Perform login before capture when authentication is not under test. Store browser state as a protected secret with an owned process for creation, access, expiry, and review.

Never commit storage-state files, client private keys, bearer tokens, or raw HAR files generated from a personal account. Keep client-certificate material outside attachments and follow the Playwright client-certificate configuration guide. A certificate path can itself expose workstation or repository structure.

Make tenant isolation visible in fixture names and safe correlation IDs. A sanitizer must not become permission to capture another tenant's real payload. Test data policy should prevent cross-tenant records from entering the browser or API response in the first place.

Separate secret detection from secret display. Scanner output should identify file, entry index, field path, rule, and severity without echoing the matched value. Restrict logs from the scanner itself and avoid shell tracing around secret-bearing commands.

When exposure occurs, stop publication, quarantine the artifact, rotate the credential through its owning system, and investigate every destination that may have copied it. Deleting one CI artifact does not revoke a token or remove notification previews.

Debug Leaks and Broken Evidence

Trace the artifact lifecycle from capture through storage. The first unsafe copy may exist before the sanitizer runs.

Check stale files first. A failed test can leave a previous attempt's sanitized derivative beside a new raw artifact. Include test ID, retry index, and random run identifier in the quarantine manifest, then verify the derivative points to the current source hash without publishing the raw hash as a secret surrogate.

When expected network entries are missing, diagnose routing and Service Worker ownership with the Playwright route debugging guide. Do not widen the HAR filter to all traffic before proving the target path and registration order.

If the trace lacks enough evidence after minimization, revisit the decision. Enable one required channel with synthetic data rather than restoring every capture option. Run CLI trace analysis in the restricted environment to confirm the minimal artifact still answers the intended question.

Add a Fail-Closed CI Publication Gate

Treat artifact publication as a pipeline with its own terminal state. Test pass, test fail, evidence approved, evidence rejected, and evidence unavailable are distinct outcomes. Product results must remain visible even when evidence cannot be uploaded.

Example 3: Reject known canaries without printing their values

import { readFile } from 'node:fs/promises';

type Canary = { id: string; value: string };

export async function assertCanariesAbsent(
  artifactPath: string,
  canaries: Canary[],
): Promise<void> {
  const content = await readFile(artifactPath, 'utf8');
  const violations = canaries
    .filter(canary => content.includes(canary.value))
    .map(canary => canary.id);

  if (violations.length > 0) {
    throw new Error(
      `Artifact policy failed for canary rules: ${violations.join(', ')}`,
    );
  }
}

Canaries supplement format-aware inspection; they do not replace it. Use synthetic values that can safely exist in scanner memory and never include the value in the thrown error. Binary traces need an approved archive scanner rather than reading the ZIP bytes as if they were plain text.

Apply these CI gates:

1. Fail publication when capture was broader than the approved endpoint and time scope.
2. Fail when finalization, parsing, sanitization, format coverage, canary checks, or secret scanning is incomplete.
3. Fail when the derivative lacks required safe diagnostic fields.
4. Never attach or upload the raw quarantine path through the ordinary reporter.
5. Emit a safe policy result with test ID, policy version, artifact class, and owner.
6. Expire raw and published files independently, with shorter defaults for raw material.
7. Preserve the product test result even when evidence publication is rejected.

Integrate the gate with the Playwright evidence pipeline so HAR, trace, screenshots, video, and logs receive format-specific checks. Review the pipeline through Playwright API testing practices when API fixtures generate transport artifacts outside the browser path.

Keep scanner dependencies pinned and test them with positive and negative fixtures. Record supported formats and maximum sizes. A new Playwright trace format, compressed HAR, or attached body layout should fail as unsupported until the scanner is verified.

Frequently Asked Questions

Does Playwright have a universal HAR and trace redaction API?

No. Playwright provides controls that reduce capture, including HAR URL filtering, body omission, minimal mode, temporal scope, and trace screenshot, snapshot, or source choices. It does not provide one supported API that finds and replaces every arbitrary secret value across HAR, trace, screenshots, DOM snapshots, attachments, and logs.

Does content: 'omit' make a HAR safe to publish?

No. It avoids persisted content text or attached resource bodies, but URLs, headers, cookies, body-derived form parameters, hostnames, and other retained fields may still expose sensitive information. Treat omission as one minimization control, then parse, inspect, scan, classify, and approve the finalized artifact before publication.

Is HAR minimal mode the same as secret redaction?

No. Minimal mode keeps information Playwright needs for HAR routing and omits fields such as sizes, timing, page, cookies, and security information that replay does not require. It is a storage profile, not a policy-aware secret detector. Remaining URLs, headers, matching data, or attached content still require review.

Can I sanitize a HAR used for routeFromHAR replay?

Yes, but changing URLs, methods, POST bodies, or matching headers can change which browser requests match recorded entries. Sanitize the HAR as structured data, preserve only required fixture fields, and rerun replay from a clean environment. Never assume a syntactically valid sanitized file remains behaviorally equivalent.

Should a trace ZIP be edited after recording?

Avoid treating the trace archive as a general redaction format. Its internal resources must remain consistent for Trace Viewer, and arbitrary ZIP rewrites can corrupt evidence or miss duplicate values. Prefer controlled data and reduced capture before recording, then quarantine or discard a trace that fails policy scanning.

When should CI upload HAR or trace artifacts?

Upload only after finalization, policy scanning, and classification succeed. Keep raw artifacts in a restricted local quarantine while checks run, publish the smallest approved derivative, and delete or expire raw material under an owned retention rule. Failure status alone must not automatically authorize an unsafe artifact upload.

Practice Evidence That Is Safe to Keep

Choose one authenticated failure that currently retains a broad trace or HAR. Replace real data with synthetic records, move recording around the smallest useful action, disable every unneeded channel, and add canaries to URL, header, body, DOM, and attachment fixtures. Prove the publication gate rejects each unsafe variant without printing the canary.

Then bring the pipeline to QABattle's automation battles and defend both sides of the decision: enough evidence to assign the failure, and little enough data to retain safely. The strongest implementation states plainly where Playwright minimization ends, where policy-specific sanitization begins, and why an unscanned failure artifact never earns an automatic upload.