OpenReplay

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me session replay that replaces a hosted OpenReplay: what the user actually saw, with the network and console beside it — and read the privacy section before you record anybody.

Read this first. Session replay records a person using your product: what they typed, where they moved, what was on their screen. It is the most invasive thing in this catalogue, and it is routinely deployed without anybody thinking about that. Build it with masking on by default, a stated retention, and a way for a person to be excluded — or do not build it. A replay tool that captures a password field once has done something you cannot undo.

STACK
- Node 20+ with Fastify for ingestion and the interface
- SQLite through better-sqlite3 for metadata, plain files or an S3-compatible store for the event streams
- rrweb for recording and playback. Do not write a DOM recorder — it is years of edge cases
- Caddy in front

THE DATA MODEL
- sessions: id, project_id, visitor_hash, user_external_id, started_at, ended_at, duration_ms, page_count, event_count, country, device, browser, os, screen_bucket, bytes, has_error, has_rage_click, has_dead_click, is_bot
- pages: id, session_id, path, title, entered_at, left_at, load_ms, largest_contentful_paint_ms
- events_blob: one compressed file per session holding the rrweb stream
- issues: id, session_id, kind, at_ms, detail_json — an error, a rage click, a dead click, a slow response
- network: id, session_id, at_ms, method, url_path, status, duration_ms, request_bytes, response_bytes
- console: id, session_id, at_ms, level, message
- consents: visitor_hash, decision, at — if you are asking, and in many places you must

MASKING, WHICH COMES BEFORE EVERYTHING ELSE
- Mask by default, reveal by exception. The opposite ordering guarantees that something sensitive is captured on the first day
- Every input's value masked unless explicitly allow-listed. Password fields never captured under any configuration — remove the code path entirely rather than making it a setting
- Payment fields, and anything inside an element marked sensitive, replaced with blocks before the event leaves the browser. Masking on the server is too late: the data has already travelled
- Text nodes maskable per selector, so a page showing personal data is recorded as layout without content
- Files, canvases and iframes not captured unless deliberately enabled
- A test page containing a password, a card number and a personal address, run through the recorder, with the stored stream inspected by hand before this goes anywhere near production. Do that every release

RECORDING
- The script is small and lazy: it must not delay the page, and it must stop recording rather than degrade the experience if the browser is struggling
- Sampling: record a percentage of sessions, plus every session that hits an error, which is where the value actually is
- Buffered and sent in batches, compressed, with a cap on bytes per session — an infinite scroll page can produce enormous streams
- Stop after a maximum duration
- Never record a session where the visitor has opted out, and honour do-not-track as an opt-out even though it is unfashionable

WHAT MAKES A REPLAY USEFUL
- The network panel beside the timeline: requests with status and duration, so a stall in the recording lines up with a slow response
- Console output, including errors with stack traces
- Automatic issue detection: rage clicks, dead clicks, a form abandoned after an error, a request that failed. Those markers on the timeline are what turn hours of video into a list worth watching
- Jump to the first issue, and skip inactivity by default
- Speed control, and a keyboard for the whole thing

FINDING SESSIONS
- Filter by everything: page, error, issue kind, duration, country, device, user identifier, custom traits from your application
- Save a filter as a list you return to
- Sessions listed with their issues visible, so the choice of what to watch is informed

RETENTION AND RIGHTS
- A stated retention — days, not months — enforced by a sweeper that actually deletes both metadata and blobs
- Deletion by user identifier, so a request to be erased can be honoured in one command, including from backups' next cycle
- An exclusion list by identifier and by address hash
- Access to replays restricted and audited: every viewing recorded with who watched what. That log is what keeps this tool honest inside your own company
- Every one of these written in your privacy notice in plain words

OPERATIONS
- .env: DATABASE_PATH, BLOB_PATH, BASE_URL, HASH_SALT, SESSION_SECRET, RETENTION_DAYS, SAMPLE_RATE
- Migrations on boot, each once
- Storage is the expensive half: measure bytes per session early and set the sampling rate from that, not from optimism
- Disk watchdog that sheds recording rather than filling the volume
- Health endpoint reporting ingest lag and free space

WHAT MATTERS MOST
Masking and retention. Build mask-by-default, then inspect a real recorded stream by hand for anything you would not want to read aloud. Everything else here is a video player — this is the part where getting it wrong is a breach rather than a bug.

Give me the repository, the recorder configuration, the player, migrations, .env.example, the masking test page, and a README that opens with the privacy position.