Bug Description
Title: Flutter web canvas recordings don't support masking of painted Text widgets
Description:
When using Flutter web with CanvasKit rendering and Canvas capture enabled for session replay, there appears to be no supported way to mask Text widgets that are painted directly to the canvas.
Environment:
Platform: Flutter web (CanvasKit)
PostHog Flutter SDK: 5.11.0
Canvas capture: Enabled in project settings
Widget types: Plain Text widgets displaying sensitive PII (user names, emails)
Expected behavior:
Setting config.sessionReplayConfig.maskAllTexts = true should mask text content in session replays, including text rendered to canvas on Flutter web.
Actual behavior:
maskAllTexts and maskAllImages in sessionReplayConfig appear to only apply to mobile screenshot-based replay (iOS/Android)
On Flutter web, these config options are no-ops during setup()
JavaScript web SDK masking options like maskTextSelector can't reach inside canvas pixels
Sensitive text rendered by Flutter to the canvas remains visible in session replays
Steps to reproduce:
Set up Flutter web app with CanvasKit renderer
Initialize PostHog with session replay enabled:
dart
final config = PostHogConfig('<ph_project_token>');
config.sessionReplay = true;
config.sessionReplayConfig.maskAllTexts = true;
await Posthog().setup(config);
Enable Canvas capture in PostHog project settings
Display sensitive data using Text widgets
Record and view session replay
Observe that text is still visible
Questions:
Is masking of canvas-rendered text supported for Flutter web?
If not, are there plans to add this capability?
Should the documentation clarify that sessionReplayConfig masking only applies to mobile platforms?
Additional context:
The Flutter session replay installation docs and privacy controls docs don't explicitly distinguish between mobile and web behavior for these masking options.
Debug info
- [ ] PostHog Cloud, Debug information: [please copy/paste from https://us.posthog.com/settings/project-details#variables or https://eu.posthog.com/settings/project-details#variables]
- [ ] PostHog Hobby self-hosted with `docker compose`, version/commit: [please provide]
- [ ] PostHog self-hosted with Kubernetes (deprecated, see [`Sunsetting Kubernetes support`](https://posthog.com/blog/sunsetting-helm-support-posthog)), version/commit: [please provide]
Bug Description
Title: Flutter web canvas recordings don't support masking of painted Text widgets
Description:
When using Flutter web with CanvasKit rendering and Canvas capture enabled for session replay, there appears to be no supported way to mask Text widgets that are painted directly to the canvas.
Environment:
Platform: Flutter web (CanvasKit)
PostHog Flutter SDK: 5.11.0
Canvas capture: Enabled in project settings
Widget types: Plain Text widgets displaying sensitive PII (user names, emails)
Expected behavior:
Setting config.sessionReplayConfig.maskAllTexts = true should mask text content in session replays, including text rendered to canvas on Flutter web.
Actual behavior:
maskAllTexts and maskAllImages in sessionReplayConfig appear to only apply to mobile screenshot-based replay (iOS/Android)
On Flutter web, these config options are no-ops during setup()
JavaScript web SDK masking options like maskTextSelector can't reach inside canvas pixels
Sensitive text rendered by Flutter to the canvas remains visible in session replays
Steps to reproduce:
Set up Flutter web app with CanvasKit renderer
Initialize PostHog with session replay enabled:
dart
final config = PostHogConfig('<ph_project_token>');
config.sessionReplay = true;
config.sessionReplayConfig.maskAllTexts = true;
await Posthog().setup(config);
Enable Canvas capture in PostHog project settings
Display sensitive data using Text widgets
Record and view session replay
Observe that text is still visible
Questions:
Is masking of canvas-rendered text supported for Flutter web?
If not, are there plans to add this capability?
Should the documentation clarify that sessionReplayConfig masking only applies to mobile platforms?
Additional context:
The Flutter session replay installation docs and privacy controls docs don't explicitly distinguish between mobile and web behavior for these masking options.
Debug info