Deploy BugMojo to your organization

• You need the extension ID: the 32 letter ID at the end of the Chrome Web Store listing URL. The examples below use <extension-id> in its place.
• Browsers must be managed: Google Admin (Chrome Enterprise Core), a Windows domain or Intune, or a macOS configuration profile. Check what reached a browser at chrome://policy.
• Microsoft Edge reads the same policies under its own names and paths (Microsoft\Edge in place of Google\Chrome).

The simplest route is Chrome’s ExtensionInstallForcelist policy. Each entry is the extension ID and the Chrome Web Store update URL, separated by a semicolon:

ExtensionInstallForcelist:
  <extension-id>;https://clients2.google.com/service/update2/crx

Force installed extensions cannot be removed or turned off by the user, and they update automatically from the Chrome Web Store.

ExtensionSettings does the same install and more, in one JSON value keyed by the extension ID:

{
  "<extension-id>": {
    "installation_mode": "force_installed",
    "update_url": "https://clients2.google.com/service/update2/crx",
    "toolbar_pin": "force_pinned",
    "runtime_blocked_hosts": [
      "*://*.hr.acme.com",
      "*://*.payroll.example.com"
    ],
    "runtime_allowed_hosts": [
      "*://status.hr.acme.com"
    ]
  }
}

• installation_mode: force_installed installs it and stops users from removing it. Use normal_installed to install it but let users turn it off.
• toolbar_pin: force_pinned keeps the BugMojo icon on the toolbar, where people look for it when they hit a bug.
• runtime_blocked_hosts stops the extension from reading or changing pages on those hosts, whatever the user allows. Patterns have no path: *://*.example.com. runtime_allowed_hosts carves exceptions out of the blocked list. Chrome reads at most 100 entries in each list and ignores the rest, so use broad patterns, or BugMojo’s own blockedDomains below, which has no such limit.

BugMojo asks for no access to other websites at install. It works on a page once the user clicks its icon there, and keeps its short instant replay buffer only on sites each user turns on. Chrome’s host blocking sits underneath all of that, as a hard floor.

For controls Chrome cannot express, BugMojo reads a managed policy that your device management tool pushes to the extension. Chrome checks it against the schema the extension ships and stores it where only the extension can read it; neither the extension nor the user can change it. Every key is optional, and each one can only make BugMojo record less or redact more.

A full example:

{
  "allowedDomains": ["app.acme.com", "staging.acme.com", "localhost"],
  "blockedDomains": ["hr.acme.com", "mail.google.com"],
  "lockRedaction": {
    "email": true,
    "creditCard": true,
    "authHeader": true,
    "jwt": true,
    "secrets": true,
    "maskAllInputs": true,
    "blockSelector": ".patient-record, [data-pii]",
    "customPatterns": ["ACME-\\d{6}"]
  },
  "disableVideo": false,
  "disableAudio": true,
  "pauseByDefault": false,
  "workspaceSlug": "acme"
}

• Domains match the domain and every subdomain. A leading *., a scheme, a port or a path is ignored, so https://www.acme.com/app means acme.com.
• Local development hosts are not exempt. If you set allowedDomains and your developers record on their own machines, add localhost and 127.0.0.1.
• Test selectors before you push them, for example with document.querySelectorAll in DevTools. A selector the browser cannot parse is dropped, so it never stops the recording, but it also protects nothing.
• Changes apply without a restart: open pages pick up a new policy within seconds of Chrome receiving it.
• BugMojo also ships a built in list of sites it never keeps a replay on (webmail, password managers, banks, payment pages, patient portals). Your blockedDomains adds to it and also stops captures there.

A control your policy locks still looks and works like a control. It shows a Managed by your organization note, and a click explains the rule instead of silently doing nothing. On a blocked site the side panel says your organization does not allow recording there, and a capture explains why it stopped. Nothing is hidden from the person using it.

1. Go to Devices, Chrome, Apps & extensions, Users & browsers, and pick the organizational unit.
2. Add the extension from the Chrome Web Store by its ID. Set Installation policy to Force install, or Force install + pin to browser toolbar.
3. Paste BugMojo’s policy into Policy for extensions. The Admin console wants each key wrapped in a Value object:

{
  "allowedDomains": { "Value": ["app.acme.com", "staging.acme.com"] },
  "blockedDomains": { "Value": ["hr.acme.com"] },
  "lockRedaction": { "Value": { "maskAllInputs": true, "secrets": true } },
  "workspaceSlug": { "Value": "acme" }
}

Site blocking lives on the same page, under the extension’s permissions and URL access settings, and maps to runtime_blocked_hosts.

• Create a configuration profile for Windows 10 and later with the Settings catalog. Under Google Chrome, Extensions, set the force installed list and Extension management settings (paste the ExtensionSettings JSON above). The same settings exist under Microsoft Edge.
• BugMojo’s own policy lives in the registry. Push it with a PowerShell script or a remediation, or import Chrome’s ADMX templates. Lists and objects can be written as JSON strings:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\3rdparty\extensions\<extension-id>\policy]
"allowedDomains"="[\"app.acme.com\", \"localhost\"]"
"blockedDomains"="[\"hr.acme.com\"]"
"lockRedaction"="{\"maskAllInputs\": true, \"secrets\": true}"
"disableAudio"=dword:00000001
"workspaceSlug"="acme"

For Edge, use HKLM\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\<extension-id>\policy. Group Policy works the same way on domain joined machines.

• Create a configuration profile with an Application & Custom Settings payload for the preference domain com.google.Chrome, holding ExtensionInstallForcelist and ExtensionSettings.
• Add a second payload for the domain com.google.Chrome.extensions.<extension-id> with BugMojo’s keys (arrays and dictionaries as plist types, booleans as booleans).
• For Edge, the domains are com.microsoft.Edge and com.microsoft.Edge.extensions.<extension-id>.

Chrome reads JSON policy files from /etc/opt/chrome/policies/managed/. Extension policy goes under 3rdparty:

/etc/opt/chrome/policies/managed/bugmojo.json

{
  "3rdparty": {
    "extensions": {
      "<extension-id>": {
        "blockedDomains": ["hr.acme.com"],
        "lockRedaction": { "maskAllInputs": true }
      }
    }
  }
}

Firefox takes the same keys in policies.json under 3rdparty.Extensions, keyed by the add on ID.

1. Open chrome://policy, press Reload policies, and find the BugMojo extension ID. Every key you set should be listed with status OK. A key in error did not match the schema and is ignored.
2. Open BugMojo’s Settings in the side panel. Locked controls show Managed by your organization, and the instant replay section lists your allowed and blocked domains.
3. Visit a blocked domain: the side panel says recording is not allowed there.

See our Security overview, client side redaction, the subprocessor list and the Data Processing Agreement. Rolling BugMojo out and need a hand? Email contact@bugmojo.com.