Security at BugMojo

The strongest privacy control is the data we never collect. By default:

• Network request and response bodies are never captured. We record request metadata (URL, method, status code, timing), but the bodies are hard-nulled in the capture code. They are not sent to us and not stored, so a payload with personal data or secrets simply never reaches BugMojo.
• Inputs are masked at capture time. Input values are masked by default (maskAllInputs) in both the extension and the widget, so what a user types, including passwords, is replaced before the replay is built.
• Authorization headers are masked at the source. Bearer/Basic auth header values are masked at capture time, so credentials in headers are scrubbed before anything is serialized.
• Other tools’ privacy markers are honoured. If a site already marks elements as private for FullStory, Hotjar, Sentry, PostHog, LogRocket, Amplitude, Datadog or Microsoft Clarity, BugMojo masks or leaves out those elements too, in both the extension and the widget.
• DOM recording first. Session replay uses rrweb to reconstruct the DOM. Tab video is opt-in per capture in the Chrome extension only (a runtime tabCapture permission granted from a user gesture); there is never a background screen recording or camera stream.

Redaction runs in the browser, before any data leaves the page. On top of the default input/text masking, the capture path scans console and network strings for PII and high-entropy secrets (API keys, tokens, private keys) and replaces them with placeholders at the source.

Because we don’t want to trust the client build alone, captures submitted through the embeddable widget also pass through a server-side secret scan as a defense-in-depth backstop: if a recognizable secret pattern slips through, it is redacted server-side before the artifact is stored, so a single missed rule does not become a leak. Extension captures upload straight to storage through short-lived signed URLs and are not re-scanned on the server; for those, the in-browser redaction above is the control.

Redaction is configurable, but it can only get stricter, never weaker. A workspace owner or admin can set an organization redaction floor, a minimum policy that is merged over every board’s widget configuration when config is served. Project-level settings and end users can raise redaction above the floor, but cannot drop below it. This is the governance control an enterprise needs to guarantee a baseline across teams. Today the floor applies to widget captures and to extension Test Runs; for everyday extension captures, each member’s own redaction settings apply.

Capture is governed by remote configuration, not by shipping new code:

• Per-environment enablement. You choose which environments (development, staging, production) the widget captures in.
• Sampling. A deterministic sample rate lets you record a fraction of sessions rather than all of them.
• Dashboard kill switch. Capture can be turned off for a project/environment from the dashboard, and the change propagates via config, with no redeploy.
• Suspension is enforced at ingest. A suspended workspace stops accepting captures server-side, independent of any client state.

All traffic to and from BugMojo is encrypted in transit with HTTPS/TLS. Capture artifacts (recordings, logs, and screenshots) are stored as files in cloud object storage (AWS S3), encrypted at rest, and uploaded through short-lived presigned URLs rather than exposing any storage credentials to the browser. Console and network logs are stored as separate, compressed objects rather than inline in the primary database, limiting blast radius.

Data is scoped to your workspace and its members, enforced on every request. Access uses:

• Roles & permissions. Five roles (Owner, Admin, Developer, QA, Viewer) map to an explicit permission matrix; every server call re-checks membership and permission for the acting company.
• Revocable API keys. Programmatic and MCP access uses API keys that are shown once, stored only as a hash, and revocable at any time. A key belongs to one workspace and is read-only unless you allow writes when you create it.
• Scoped, revocable MCP OAuth grants. AI agents can also connect through OAuth 2.1. When you connect one, you pick a single workspace and what it may do (bugs:read, replay:read, bugs:write, admin), with read only preselected. The agent never gets more than your own role in that workspace. Clients connected before scopes existed keep read and write access within your role until you reconnect them. You can review and revoke grants at any time.
• An AI off switch. A workspace owner or admin can turn off AI agents and MCP for the whole workspace: connected AI clients are then refused, and BugMojo agents stop running. See AI data use.
• Company audit log. On every plan, including Free, owners and admins can review a trail of security-relevant actions (member and role changes, integration connect/disconnect, API-key create/revoke, and capture/redaction policy changes) from workspace settings. It also records AI access: each AI client connected over MCP, the bugs it read (the first read per client, per bug, per hour) and every agent run. It does not yet record who viewed or downloaded a recording in the dashboard.

BugMojo runs on established cloud infrastructure. We use a small set of vetted subprocessors to operate the service: app hosting (Vercel), the database (Neon), object storage for capture artifacts (AWS S3), transactional email (Zoho Mail, with Resend as a backup), rate limiting (Upstash), and error monitoring (Sentry). See the full list of subprocessors and our Privacy Policy for how data is shared and retained.

You can delete individual captures, issues, or your entire account at any time; deletion removes the associated stored artifacts, including the underlying S3 files. Quick Capture links expire automatically (anonymous captures after 7 days and free-tier captures after 30 days), so ephemeral data doesn’t linger. Session-replay retention windows scale by plan. You can also export or erase your personal data on request (see Compliance).

The extension talks only to BugMojo (the BugMojo API, plus our own storage bucket through short-lived signed upload URLs) to authenticate and upload the bugs you capture. It shows a consent dialog before it records anything, and stores your session and preferences locally on your device.

After you consent, instant replay keeps a short rolling buffer of recent page activity in memory on your device (15 seconds to 2 minutes, your choice, and you can pause it) so a capture includes what led up to the bug. By default it runs only on your own sites: local development hosts, the domains set on your workspace’s projects, and sites you turn on yourself. Recording on every site is an opt-in setting, and even then a built-in list of banking, webmail, password-manager, payment and health sites is skipped unless you add one of them yourself. The buffer runs only in the tab you are looking at, never in background tabs.

Nothing is uploaded until you capture. Network request and response bodies are never captured, and elements a site has marked private for other session-replay tools (FullStory, Hotjar, Sentry, PostHog, LogRocket and others) are masked or left out.

IT teams can force install the extension, keep it off chosen sites and lock its privacy settings with browser policy. See Deploy to your organization.

If you believe you’ve found a security vulnerability, we want to hear from you. Please email contact@bugmojo.com with details and steps to reproduce. Give us a reasonable window to investigate and fix the issue before any public disclosure, and please don’t access or modify data that isn’t yours while testing. We appreciate good-faith research and will acknowledge your report.

For full terms, including our safe-harbor commitment, scope, and expected response times, see our Vulnerability Disclosure Policy.

Security questions or a due-diligence review? Email contact@bugmojo.com. For a Data Processing Addendum, see /dpa.