Workflow: roll out Session Replay without leaking PII

# Workflow: roll out Session Replay without leaking PII

Replay is the fastest way to understand a frontend bug, and the fastest way to record a credit card number. Roll it out in stages with privacy first.

## 1. Add the integration with conservative rates

```js
Sentry.init({
  dsn: "[your-dsn]",
  integrations: [Sentry.replayIntegration({ blockAllMedia: true })],
  replaysSessionSampleRate: 0.1,
  replaysOnErrorSampleRate: 1.0,
});
```

Session sampling at 0.1 keeps quota sane; error sampling at 1.0 guarantees the replay exists for the sessions that matter. `blockAllMedia` blocks images and video by default.

## 2. Audit what gets masked

By default, replay masks all text and blocks media, unmasking only what you explicitly allow. Walk your highest-traffic pages and confirm: form inputs masked, auth pages fully blocked, nothing sensitive visible in a test replay.

## 3. Unmask surgically

Only unmask elements that are needed to debug and contain no PII, using the SDK's unmask selectors. Every unmask rule is a privacy decision; document why each exists.

## 4. Gate regulated pages

For checkout, health, finance, or any page with regulated data URIs either block replay entirely on those routes or require explicit user consent before starting it. Check the session URL before initializing the integration.

## 5. Watch the quota

Replays are their own quota category. A rate change from 0.1 to 1.0 is a 10x cost change; review usage after the first week and adjust.

## Verify

Trigger errors on representative pages and watch the resulting replays: inputs masked, media blocked, and no sensitive data visible. Then confirm the replay attaches to its error event so triage flows from issue to recording in one click.