The reason a Gleap bug report is worth more than an email is what comes with it: the console output, the requests that were in flight, and a recording of what the user was doing. All of it is captured before the report, so it's there whether or not the customer thought to mention it.
On the web, the SDK keeps a rolling buffer of console output and attaches the most recent entries. You don't have to do anything — it's on.
You can add your own entries, which is more useful than it sounds: a line at each step of a checkout flow tells you exactly how far someone got.
Gleap.log("Checkout: payment step reached");
Gleap.log("Token refresh failed", "ERROR");If overriding the console clashes with your own logging setup, turn the override off with Gleap.disableConsoleLogOverwrite() — your explicit Gleap.log calls still work.
The SDK records recent HTTP requests — URL, method, status, and payloads — keeping the last few dozen. Requests to Gleap itself are excluded.
Two controls, and most teams want both:
// Don't record these endpoints at all
Gleap.setNetworkLogsBlacklist(["/auth", "/payments"]);
// Record the request, but strip these fields
Gleap.setNetworkLogPropsToIgnore(["password", "token", "ssn"]);Blacklist an endpoint when nothing about it is safe to keep; strip properties when the request is useful for debugging but a few fields aren't.
You can also raise or lower how many requests are kept with Gleap.setMaxNetworkRequests.
Web replays are off until you switch them on: Project settings → Developer options → Enable web replays, then reload your app.
What's recorded is the DOM, not video — the page is reconstructed on playback. It keeps a rolling window of roughly the last ten to fifteen minutes, so a report always carries the run-up to the problem rather than the whole session.
Password fields are masked. Other input values are not — they're kept, because seeing what someone typed is usually the point.
If your app handles personal or regulated data, change that. Set the options before initialize:
Gleap.setReplayOptions({ maskAllInputs: true });
Gleap.initialize("YOUR_API_KEY");For finer control, three CSS classes work per element:
rr-block — replaced with a placeholder of the same size.
rr-ignore — skipped entirely.
rr-mask — text replaced with asterisks.
Put rr-mask on the elements that show customer data and rr-block on anything you'd rather not reconstruct at all.
The mobile SDKs work differently: they take a screenshot every few seconds and keep the most recent ones, so a report arrives with a short flip-book of the screens leading up to it rather than a DOM recording.
The window is short by design — it covers what just happened, not the whole session.
For errors you catch yourself, Gleap.sendSilentCrashReport files a report with all the same data attached, without showing the customer anything. It's the right call for exceptions your users can't act on and shouldn't be interrupted by.