skip to content

In Cypress Cloud, how do you decide what Test Replay captures and who can see it?

level: principalimportance: should knowfreq 28%

answer

  1. Capture is an exposure question first
  2. Four dials, in increasing cost
  3. It happens on your machine, before upload
  4. Everyone with project access can watch
  5. Opting out is the last resort

basics

~20 s

Treat it as an exposure decision, not just a debugging one. Test Replay uploads DOM, styles, the Command Log, network traffic and console logs to everyone with project access. Keep redaction on, tighten project visibility, and opt out last.

solid answer

~40 s

A recorded run already stores results, test definitions, configuration, screenshots, videos and CI metadata. Enabling **Test Replay** adds the rendered **DOM and CSS**, the **Command Log**, the application's **network traffic** and **browser console logs** — which is precisely why it is worth having, and precisely why it needs a decision. That data is visible to everyone with access to the project, so the first dial is project visibility, not capture. The second is the **network redaction** default, which strips known credential headers, token fields and JWT-shaped values on your machine before upload. Only then consider narrowing capture: the canvas toggle for heavy rendering, and finally the project-level opt-out, which costs you the ability to debug CI failures at all. Push sensitive values out of your fixtures rather than switching capture off.

code

bash · 1 line
bash
cy-cloud replay info --testId 7c1e9d20-5a3b-4c8d-9e0f-1a2b3c4d5e6f

go deeper

for a junior

Know that Test Replay uploads the DOM, the Command Log, network traffic and console logs, and that anyone with access to the Cloud project can watch the result.

for a middle

Explain the redaction default: it runs locally before upload, covers credential headers, token fields and JWT-shaped values, and drops bodies it cannot evaluate.

for a senior

Show you would reach for project visibility and test data before touching capture, and that you can name what disabling Test Replay actually costs a CI-only investigation.

for a principal

Own the standard for the whole organisation: what may appear in seed data, who a project is visible to, and the explicit trade between debuggability and exposure.

## What a recorded run holds, with and without replay The decision starts with knowing what actually leaves the machine. Recording a run already sends a fixed set of things; Test Replay adds a second, much richer set. | Always stored on a recorded run | Added when Test Replay captures | | --- | --- | | Standard output of the run | The rendered DOM and CSS of the app under test | | Test results and test definitions | Cypress commands and events from the Command Log | | Cypress configuration | Network traffic within the app under test | | Screenshots and videos | Browser console logs | | CI and git environment metadata | | Nothing about the application's source code or its repositories is captured. What is captured is the application's *runtime state*, which for a storefront monorepo means order totals, addresses, discount codes and whatever your seeded accounts happen to contain. ## The dials you actually have There are four, and they are not equally good. Reach for them in this order: 1. **Project visibility.** A private project is visible only to invited members of the organisation with the right role; a public one is visible to any Cloud user. This is the widest-reach dial and the cheapest to get right, because it costs no debugging capability at all. 2. **Network data redaction**, which is on by default. It runs **in the Cypress app, on your own machine, before upload**, and replaces known-sensitive values with `(redacted)`: authentication and token headers such as `authorization` and `set-cookie`, credential fields in bodies such as `password` and `refresh_token`, tokens passed as URL parameters, and anything shaped like a JWT or a SAML response. Request timing, status codes and request structure survive, so you keep the debugging context without the values. 3. **The canvas capture toggle.** Capturing canvas elements is resource-intensive; a storefront with large canvas-rendered charts can slow its own runs down. This is a performance dial that happens to reduce capture. 4. **The project-level opt-out**, which stops DOM, Command Log, network and console capture entirely. It is the only one that costs you the feature. ## What redaction costs, and why it is still the default Redaction is not free. When it cannot evaluate a response body — a body too large to scan, or one it cannot decode to text — the body is **dropped entirely** rather than uploaded unexamined, and shows as unavailable in the network log. So the safe default occasionally removes the exact response you wanted to read. That is the right trade in almost every project: the cost is one debugging session, the alternative cost is a credential sitting in a replay that everyone with project access can open. Note also what redaction does **not** do. It works on network requests and responses. Values your application renders into the DOM are captured as rendered, and values your spec types are visible in the Command Log. Masking those is a test-data problem, not a redaction setting. ## How I would decide it For a storefront monorepo whose specs run against seeded accounts, the sequence that holds up is: - **Keep capture on.** Turning off Test Replay to solve a data problem trades away the one tool that makes a CI-only flake diagnosable, and does nothing about the screenshots and videos that were already being uploaded. - **Fix the data, not the capture.** Seeded accounts should hold data you would be comfortable showing the whole engineering organisation. If a spec needs a real credential, it should come from a secret at run time and be one of the values redaction already covers. - **Set visibility deliberately.** Decide once whether the project is public, and if so accept that every replay is public too. - **Leave redaction on** and treat a dropped body as a prompt to shrink the response the test depends on, not as a reason to switch redaction off for the whole project. - **Revisit the canvas toggle only on evidence** — the upload sizes and durations are printed in the run's own output, so this is a measured decision rather than a guess. The Cypress Cloud CLI (`cy-cloud`) will also summarise a single replay's command, network and log event counts, which is a cheap way to see how much one spec is really capturing before you argue about it. One side effect is worth knowing when you weigh capture against artifacts: when Test Replay is enabled, Cypress does not render the Runner UI during `cypress run`, because Cloud regenerates that interface for the replay. Screenshots and videos from those runs therefore show the application alone unless you ask for the interface back with `--runner-ui`, at some cost in run performance.

  • Someone asks you to disable Test Replay because a spec logs in as a real user. Is that the right fix?
    Usually not. Disabling it removes the whole debugging surface while screenshots and videos keep uploading, so the exposure barely moves. Redaction already strips credential headers, token fields and JWT-shaped values before upload; the durable fix is to stop putting real identities in the seed data and to source any genuine secret at run time.
  • What does network redaction not protect, and how do you cover that?
    It works on captured requests and responses. Values rendered into the page are recorded as part of the DOM capture, and values a spec types appear in the Command Log. Those are test-data decisions: seed the storefront with data you would show the whole organisation, and keep genuine secrets out of the browser entirely.

saying these in an interview costs you the question

  • Turns off Test Replay and calls the data problem solved
  • Assumes redaction happens after upload in the Cloud
  • Thinks a private project hides replays from teammates
  • Believes redaction masks values rendered into the page
  • Decides the canvas toggle without measuring upload cost