Open issues
Every report arrives with its replay, network calls and correlation IDs.
| Severity | Issue | Failed | Status |
|---|
OneTrace ConsoleOneTrace ConsoleEvery report arrives with its replay, network calls and correlation IDs.
| Severity | Issue | Failed | Status |
|---|
Reports with the same failed request, console error or step are grouped. Triage a problem once and every report in it follows.
| Severity | Problem | Reports | Status |
|---|
Share of this problem's reports
Select one to see its replay and evidence. Move a report that doesn't belong.
| Severity | Issue | Failed | Status |
|---|
Computed from the reports and the squad's triage history.
By severity as the squad set it
All open issues, whatever the period
All open issues, whatever the period
Reports in the period, grouped by failed request, console error or step. Select one to triage it.
Reports in the period
Failed calls grouped by method, endpoint and status, with IDs in the path collapsed. Select a row to see its issues.
Reports received in the period
Reports received in the period whose first response or resolve target has an outcome
Each team gets its own tokens. Testers install the extension with their team's token, and their reports and usage show here.
| Team | Active browsers 7 days | Reports 30 days | Tokens |
|---|
IP addresses are personal data under GDPR. Agree the setting with the client's DPO. Changing to anonymised or off also changes what is already stored.
People who can sign in. Only people on this list get in, with the role and teams set here. Reporters use the browser extension; the squad uses the Console.
One person per line: email, name, role, team. Name, role and team are optional; a missing role is Reporter and a missing team is the one chosen above. A CSV with that header works too.
Off: only people added here can sign in. On: anyone with a OneTrace role in the identity provider gets in and appears here, to be managed from then on.
| Person | Role | Status |
|---|
Chrome and Edge install OneTrace from this Hub and keep it updated, with nothing for people to click. No Chrome Web Store, no developer mode. This build can record and take screenshots on every allowed site.
A ceiling set by policy: whatever the allowed sites in Settings say, these machines never run OneTrace outside it. One pattern per line. Leave empty to rely on the allowed sites alone.
Chrome Enterprise Core (free) or Workspace. Any OS: Windows, macOS, Linux, ChromeOS. The most automated.
Intune, Group Policy or any software deployment. One file for Chrome and Edge.
Jamf, Intune, Kandji or any MDM. A configuration profile for Chrome and Edge.
Ansible, Puppet or by hand. A script that writes the policy for Chrome, Chromium and Edge.
The plain Chrome policy, for any other tool.
For web apps where people can't install the extension: iPhone, iPad, Android and any desktop browser. The app adds one script tag and gets the OneTrace bubble, with the masked replay, failed requests with their trace IDs, console errors and replies, the same as the extension. There is no screenshot: a web page can't photograph itself, and the replay shows the screen.
A site key goes in the app's page, so anyone can see it. It can only send reports, only from the web addresses listed on it, and never read anyone's reports. Make one per app and environment, so each can be revoked on its own.
Put the tag in the page's <head>, as early as possible, so it also catches the requests the page makes while loading.
Download onetrace.js (), serve it from the app, and say where the Hub is with data-hub. You then update it yourself; loaded from the Hub, it is always the current version.
If the app sends a Content-Security-Policy header, add the Hub to these directives (keep what is already there):
Hosting the file yourself, script-src needs nothing extra; connect-src still needs the Hub.
Reports show who reported and in which app version when the page says so:
<meta name="onetrace-user" content="agent.silva"> <meta name="onetrace-role" content="Shop agent"> <meta name="onetrace-app" content="Order capture"> <meta name="onetrace-app-version" content="4.12.0">
class="ot-mask" to an element to show only asterisks for its text, or data-ot-block to leave it out of the replay entirely.data-lang="pt" (or "en") to the script tag to fix it for the site.No bubble? Open the browser's console: OneTrace says why (a site key not valid on that web address, the Hub unreachable, or the Content-Security-Policy blocking it). On a page where the OneTrace extension is installed too, the extension takes over and the snippet stays quiet.
In production, add the tag only for the people who should report (internal users, a test group), for example behind a feature flag. Everyone who loads it keeps a few seconds of masked activity in their browser.
Everything OneTrace holds about one person, to give them a copy or erase it. Search with their email or full name, check what was found, then export or erase.
Reports they sent are selected. Reports that only mention them are listed for you to decide: other people's reports may need to stay.
A ZIP with their account, the selected reports (with conversations and history), the browsers that sent reports as them, and audit entries by or about them. The audit log records that an export was made, with a reference, not their name.
Deletes the selected reports with their conversations, their OneTrace account and browser sign-ins, and the browsers only they used. In the audit log their name is replaced by a reference, and entries about them keep only when and what happened. This cannot be undone. Copies in backups go when those backups expire (14 days).
How this Hub is doing. Monitoring tools can check /health, which needs no sign-in and shows only the overall status.
Last 24 hours
Browsers seen in the last 30 days
The last 50 lines in the Hub's error log since it started
Who signed in, opened or downloaded an issue, changed triage, replied, and changed teams, tokens or settings. Entries are never edited or removed.
Where OneTrace runs and how much of the session it keeps. Every browser picks up a change within a minute.
Built in: card numbers (checked like a bank does), IBANs, emails, Portuguese mobile numbers, NIFs (checked), JWTs, bearer tokens and secrets written as key=value; fields named like password, token, card, iban, nif, msisdn or session; and headers such as Authorization and Cookie. Paste something to see what is masked and by which rule. Changes to your rules below are tried here before you save them.
Saved rules reach browsers the next time they fetch the settings (within minutes) and apply to the Hub's second masking pass at once. They mask reports from then on; reports already stored stay as they are.
On these sites, OneTrace does not hide personal data (names, phone numbers, emails, NIF, card numbers, IBANs), so testers' reports show the real test data. Passwords, tokens, cookies and auth headers are still hidden. Only list test or staging addresses: real customers' data must never be on them. Reporters see a notice in the report form, and these reports are marked in the Console. One address per line, as Chrome match patterns, for example https://staging.client.pt/*.
How much of the session before the report the replay keeps. Requests and console messages are kept for at least twice as long.
Reports older than this are deleted, with their conversation and triage history, every hour. Agree the period with the client's DPO. Deletions are recorded in the audit log.
Upload the .map files your build makes, for the app name and version reports show (the onetrace-app and onetrace-app-version meta tags, or the site's address). They stay on the Hub, are never served, and are used only to read stack traces in reports. Reports of a version with no maps use the app's newest upload.
How soon a report should get its first response (a reply or any triage change) and be resolved, counted from when it arrived. The inbox flags reports in the last quarter of a target as "breaching soon", and past it as "breached". The resolve clock pauses while a reply marked "Waiting for the reporter" is unanswered. Leave a box empty for no target.
Each backup holds a copy of the database, the reports, the extension's signing key and a checksum of every file. To restore, stop the Hub and run node demo/backup.js restore <backup folder> <empty data folder>: it checks every file first and never overwrites existing data. Keep BACKUP_DIR on another disk than the data.
Applied to every new report, in order. A rule matches when the chosen part of the report contains the text (not case sensitive). Its actions also apply to the report's problem group.
Checks the list above, including changes you haven't saved yet.
Sent from a test environment: personal data was not masked (passwords and tokens were).