On the web platform, the Gleap Capacitor plugin runs the Gleap JavaScript SDK, so screenshots and replays use its privacy controls. The SDK masks the values of sensitive fields before they leave the page: every character becomes *.
Fields masked automatically
Password fields and fields whose autocomplete attribute contains current-password, new-password, one-time-code, cc-number or cc-csc are always masked, in screenshots from JavaScript SDK 18.1.1. Earlier versions included the values of password fields in the page snapshot behind a screenshot, so make sure your app resolves the gleap package to 18.1.1 or later.
Mask a field
Add the class rr-mask to a field, or to an element that contains fields, to mask their values:
<input name="secret" type="text" class="rr-mask" />Hide an element
Add the class rr-block to hide an element and everything inside it:
<div class="test">
<div class="left">Welcome :)</div>
<div class="right rr-block">This text is sensitive!</div>
</div>Replays record an empty placeholder of the same size instead of the element. Screenshots render the area blank, and fields inside it are masked.
Class names from older versions
This page used to document gl-mask and gl-block. From JavaScript SDK 18.1.1, gl-mask masks fields like rr-mask; earlier versions did not mask the values of gl-mask fields. Screenshots render gl-block areas blank, but replays stopped blocking them in JavaScript SDK 16.2.5, so use rr-block instead.
For all options, see Privacy controls in the JavaScript SDK documentation.