This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryAdds dashboard‑controlled image and video privacy for web replays with explicit masking attributes.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Adds dashboard-controlled image and video privacy for web replays. Adds dashboard-controlled image and video privacy for web replays. Source: llm_adapter@2026-06-01 Confidence: high |
— |
| Feature | Medium |
Adds explicit media masking attributes `data-rj-mask-media` or `data-rejourney-mask-media` for one-off sensitive areas. Adds explicit media masking attributes `data-rj-mask-media` or `data-rejourney-mask-media` for one-off sensitive areas. Source: llm_adapter@2026-06-01 Confidence: high |
— |
| Feature | Medium |
Masks media URLs at the source when privacy is enabled, scrubbing attributes like src, srcset, poster, href, xlink:href, data, rr_dataURL, alt, title, aria-label, and replacing CSS background images with none. Masks media URLs at the source when privacy is enabled, scrubbing attributes like src, srcset, poster, href, xlink:href, data, rr_dataURL, alt, title, aria-label, and replacing CSS background images with none. Source: llm_adapter@2026-06-01 Confidence: high |
— |
| Feature | Medium |
Improves self‑hosted network capture to hide only Rejourney config, ingest, and upload calls under a base path while keeping application API traffic visible. Improves self‑hosted network capture to hide only Rejourney config, ingest, and upload calls under a base path while keeping application API traffic visible. Source: llm_adapter@2026-06-01 Confidence: high |
— |
| Feature | Medium |
Keeps presigned replay upload URLs out of captured app network logs after the SDK receives an upload destination. Keeps presigned replay upload URLs out of captured app network logs after the SDK receives an upload destination. Source: llm_adapter@2026-06-01 Confidence: high |
— |
Full changelog
Browser SDK 0.4.0
Published to npm as @rejourneyco/[email protected].
Highlights
- Adds dashboard-controlled image and video privacy for web replays. When image/video masking is enabled, Rejourney blocks page media from visual replay capture while preserving the surrounding page layout so the replay is still useful for debugging.
- Adds explicit media masking attributes for one-off sensitive areas. Use
data-rj-mask-mediaordata-rejourney-mask-mediaon images, videos, canvases, SVG images, or background-image containers you always want hidden. - Masks media URLs at the source when media privacy is enabled. Replay snapshots scrub image/video attributes such as
src,srcset,poster,href,xlink:href,data,rr_dataURL,alt,title, andaria-label, and replace CSS background images withbackground-image: none. - Improves self-hosted network capture. If your API URL includes a base path, Rejourney now hides only its own config, ingest, and upload calls under that path while keeping your application API traffic visible.
- Keeps presigned replay upload URLs out of captured app network logs after the SDK receives an upload destination.
Compatibility
- No breaking API changes.
- Image/video masking is off by default, so existing web replays continue to show media unless you enable the new privacy setting.
- Existing text input masking,
rr-block,rr-mask, and custom privacy selectors continue to work as before.
Upgrade
npm install @rejourneyco/[email protected]
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About rejourneyco/rejourney
All releases →Beta — feedback welcome: [email protected]