Redaction & privacy

IDebug is for local development. Still, credentials often appear in headers and bodies.

Built-in keys (case-insensitive)

Includes (non-exhaustive):
authorization, cookie, set-cookie, password, passwd, secret, token, access_token, refresh_token, api_key, apikey, x-api-key, credit_card, ssn, private_key.

Values become the string ***.

Custom keys

IDebug.configure({
  enabled: true,
  redactKeys: ['ssn', 'taxId', 'internalToken'],
});

Merged with defaults (union).

Limits

• Max object depth (default 8)
• Max string length truncation for huge blobs

Framework vs app

Redaction is independent of the App changes only UI filter. Framework header events may still contain redacted values; the toggle only controls visibility of meta mutations, not secret scrubbing.

Production

Keep enabled: false in production builds. Do not expose /__idebug on public hosts without additional access control (none is built in).