Before sharing with HAR Desk
This opens the strict policy on a made-up checkout capture: bodies removed, ids in paths replaced, IP addresses and browser-specific fields handled. Press Sanitize to see what would change, then read the limitations and the support pack.
- Load the HAR a support team asked for, or keep the sample.
- Choose a policy: Standard keeps text bodies and scans them, Strict removes every body and replaces ids and IP addresses.
- Press Sanitize, then go through the list of changed fields and the limitations.
- Tick the review box and download the sanitized .har and the Markdown support pack to attach to your ticket.
What to know
Support teams ask for a HAR because it shows exactly what failed, but the same file can carry session cookies, bearer tokens, form passwords, email addresses and customer data in response bodies. Sanitizing is a trade: the more you remove, the safer the file and the less the engineer can see. Strict removes every body, replaces path segments that look like ids and masks IP addresses; Standard keeps text bodies for debugging and scans them.
After sanitizing you get three things. The changed-field review shows each original next to its placeholder. The limitations report lists what was scanned and, just as important, what was not: object keys, header names, free text with no recognisable shape, and anything your rules do not name. And a residual check re-runs the detectors on the output, so values that still look like secrets are flagged.
The support pack is a Markdown file with the capture summary, failing and slow requests, hosts, a redaction summary and the limitations, all taken from the sanitized file. No tool can promise that a file is safe to share: read the changes, search the output for names and internal hostnames yourself, and confirm you are allowed to send it.
Updated · Cosmovex
Questions
Is a sanitized HAR safe to send?
Not automatically. The sanitizer reduces what is recognisable as a secret; it cannot know what is sensitive in your data. Review the changes and the limitations, and check the file before you send it.
What does the support pack contain?
A Markdown summary: capture details, failing requests, slowest and largest responses, hosts, the redaction summary, what was scanned and what was not, and a reviewer checklist. It is built from the sanitized file, so it holds no original values.
Why do placeholders have numbers?
The same secret gets the same number everywhere, so an engineer can tell one session or token was reused. The number is a counter assigned in this run, not a hash, so it cannot be reversed.
What is the difference between Standard and Strict?
Standard keeps text bodies (scanned), replaces cookies, auth headers, parameters and patterns. Strict also removes all bodies, replaces id-like path segments, masks IP addresses and removes browser-specific fields.
The free plan covers everything on this page. HAR Desk Pro ($29, paid once) is described on the HAR Desk page.
