How redaction works in TweakThis

Masked before the screenshot

While the screenshot is taken, the extension covers these fields with an opaque box, then uncovers them:

• password fields;
• fields marked for card numbers, security codes, expiry dates, names on cards, one-time codes and current or new passwords (by their autocomplete value);
• fields whose name or id looks like a card number or security code;
• anything the site marks with data-tweakthis-mask, which developers can add to any element.

It decides from attributes only and never reads the values. It reaches into shadow roots, but not into frames or anything drawn on a canvas, so the editor says what it masked and that masking is not a guarantee. Text captured from an element marked with data-tweakthis-mask is removed as well.

Blacked out by the reporter

Before sending, the reporter can drag up to 50 boxes over the screenshot with the Black out tool. The boxes are burnt into the pixels in the browser, and the crop and preview are cut from that image, so the unredacted screenshot is never uploaded.

A box over the element also removes the text captured from it: its visible text, accessible name and selected text, the HTML excerpt, sibling text and labels, attributes that carry text, and the selectors built from text. The capture lists which fields were removed, so the agent knows something is missing rather than guessing.

Taken out of the page address

User names and passwords in the address are always removed. Query and fragment parameters whose names look like secrets (token, code, key, password, secret, session, auth, signature, and similar) have their values replaced with redacted. The names stay, so the agent knows they were there. The same applies to links in the captured HTML.

Never read at all

Values of form fields (what anyone typed into them), console logs, network requests and browsing history. The full list of what is captured is on what the extension captures, and how long it is kept is in the privacy policy.