Remove sensitive data

Change or drop events before they leave the browser.

Loomduct already strips URLs before they leave the page. Use beforeSend for anything else, like an id in a path or a property.

Before you start

Loomduct installed on your site. See the Quick start.

What is already removed

Page URLs keep only the address and the path, plus:

the campaign tags utm_source, utm_medium, utm_campaign, utm_term and utm_content
the name of an ad click id (gclid, gbraid, wbraid, msclkid, fbclid, ttclid, li_fat_id, twclid), with its value replaced by 1
query parameters you list in the urlParams option (data-url-params on the script tag)

Page address	Sent as
`https://shop.com/reset?token=abc123&utm_source=mail&gclid=XYZ`	`https://shop.com/reset?utm_source=mail&gclid=1`
`https://user:pass@shop.com/a?x=1#top`	`https://shop.com/a`

Referrers are sent without any query string.

Change or drop events with beforeSend

beforeSend gets every event before it is sent. Return the event, a changed copy, or null to drop it:

src/loomduct.ts

import { Loomduct } from '@loomduct/js'
import { webAnalytics } from '@loomduct/js/web-analytics'

export const loomduct = new Loomduct({
  token: 'lmt_your_project_token',
  plugins: [webAnalytics()],
  beforeSend: (event) => {
    if (event.url.includes('/admin')) {
      return null
    }
    return {
      ...event,
      url: event.url.replace(/\/invite\/[^/]+/, '/invite/:code'),
    }
  },
})

With the script tag, set it through the snippet, before or after the SDK loads.

If your beforeSend throws, the event is dropped, so data you meant to remove is never sent by mistake.

Properties you pass to identify() do not go through beforeSend.

Check that it worked

Set debug: true (or data-debug) and open a page your rule covers. The browser console shows the changed event, or no event when you dropped it.