chore(sentry): unmask replay text and media with selective opt-out hooks (#2709)

Sentry session replay defaults to masking all text and blocking all media,
which produces unreadable rows of asterisks on every replay. Turn both off
so replays are actually useful for debugging, and add .sentry-mask /
[data-sentry-mask] / [data-sentry-block] selectors so we can opt specific
customer-sensitive elements (risk descriptions, secret values, policy
markdown) back into masking as we identify them. <input type="password">
remains masked automatically by the SDK regardless.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Marfuen

apps/app/src/instrumentation-client.ts

@@ -24,7 +24,16 @@ Sentry.init({
     process.env.NEXT_PUBLIC_SENTRY_DSN ??
     'https://331f1c3d4b08e9352dd1a2621e1ae845@o4509214247813120.ingest.us.sentry.io/4511304630927360',
 
-  integrations: [Sentry.replayIntegration()],
+  integrations: [
+    // Add `data-sentry-mask` (or `.sentry-mask`) to any element rendering
+    // customer-confidential data; `data-sentry-block` to drop whole sections.
+    Sentry.replayIntegration({
+      maskAllText: false,
+      blockAllMedia: false,
+      mask: ['.sentry-mask', '[data-sentry-mask]'],
+      block: ['[data-sentry-block]'],
+    }),
+  ],
 
   tracesSampleRate: process.env.NODE_ENV === 'development' ? 1.0 : 0.1,
 

apps/portal/src/instrumentation-client.ts

@@ -9,7 +9,16 @@ Sentry.init({
     process.env.NEXT_PUBLIC_SENTRY_DSN ??
     'https://331f1c3d4b08e9352dd1a2621e1ae845@o4509214247813120.ingest.us.sentry.io/4511304630927360',
 
-  integrations: [Sentry.replayIntegration()],
+  integrations: [
+    // Add `data-sentry-mask` (or `.sentry-mask`) to any element rendering
+    // customer-confidential data; `data-sentry-block` to drop whole sections.
+    Sentry.replayIntegration({
+      maskAllText: false,
+      blockAllMedia: false,
+      mask: ['.sentry-mask', '[data-sentry-mask]'],
+      block: ['[data-sentry-block]'],
+    }),
+  ],
 
   tracesSampleRate: process.env.NODE_ENV === 'development' ? 1.0 : 0.1,