"network tab" isn't it a security concern to record API calls?
Also how future proof it is with Google changing Chrome addons permissions / API etc...?
Also how future proof it is with Google changing Chrome addons permissions / API etc...?
We do two things to address that:
The first is nothing gets recorded and saved (or even sent to our backend) until the user actively chooses to log a bug. So it’s like actively choosing to save a HAR file when there’s a bug.
The second is we scrub all network requests on the client side for anything that resembles PII or sensitive data. We just don’t want it on our servers.
Is there anything else you think we should do?
Definitely building on the Chrome platform there’s always API risk of something changing but I hope Chrome and other browsers will keep it possible to provide a better debugging experience through extensions like ours for people who want it.
Edit: it looks like this is already the case!
The tool seems to be built for people who don't know what to include in a proper bug report (As they are maybe not technical enough), so not sure how helpful that choice would be for them.
My suggestion is to have a setting that lists default headers you think should be obfuscated, and the user/team can remove and add to them as they like.
Yes! I think that's a great idea.