privacy-auditor

Privacy Auditor

Audit your Fullstory session capture for PII exposure, verify privacy rules are working, and find sessions that may contain sensitive user data.

When to Use

• "Are we accidentally capturing PII in sessions?"
• "Check if our privacy masking rules are working"
• "Did the recent deploy break any privacy exclusions?"
• "Find sessions where user emails might be visible"
• "Verify that the /admin pages are excluded from recording"
• "Audit our recording block rules — are the right elements masked?"

Mental Model

Fullstory records everything users see and do. Privacy controls prevent sensitive data from being captured:

1. Exclusion rules: Pages or elements excluded entirely from recording
2. Masking rules: Elements that are recorded but with text/images replaced
3. Block rules: Elements blocked from capture (not recorded at all)
4. Network exclusions: API calls excluded from network capture

This skill verifies that these controls are working correctly.

Workflow

Step 1: Check current privacy configuration

Call fullstory:get_recording_block_rules to see what's currently configured:

• Element selectors being masked or blocked
• URL patterns being excluded from recording
• Network URL patterns excluded from capture

Present the current rules to the user: "Here's what's currently configured. 12 element selectors masked, 3 URL patterns excluded, 1 network exclusion."

Step 2: Verify rules on actual sessions

Pull recent sessions and check if the rules are working:

fullstory:get_sessions(time_range="last_24_hours", limit=5)

For each session, use session_view to check pages that should have masked elements:

• Navigate to a page with known sensitive elements (e.g., /checkout, /settings)
• Check that password fields, credit card inputs, and other sensitive fields are masked
• Verify that excluded pages (e.g., /admin) don't appear in session data at all

Step 3: Hunt for PII leaks

Look for common PII exposure patterns: