Hello !

We have currently a leak in our app that shows what the user is typing when we look at the replay.

Everything on the page is masked (including the input with ****), but as we using query params, the record is displaying the query params (check screenshot)

I tried multiple things, but doesn't work :

• https://docs.sentry.io/platforms/javascript/session-replay/privacy/#example-scrubbing-urls
• Using beforeBreadcrumb and modifying breadcrumb.data.from and breadcrumb.data.to
• Using beforeSend and modifying event.request.url

Does anyone has the solution ?