# Filtering sensitive data

An error report is a snapshot of a moment in your application, and moments in applications contain passwords, tokens and people. Both clients filter before anything is sent, and both let you add to what they filter.

You are the data controller for whatever your application chooses to send. LaraBug processes it on your behalf. The [Data Processing Agreement](/dpa) sets out what that means in practice.

## What is scrubbed already

Both clients ship a blacklist of field names matched against request parameters and object keys: `password`, `token`, `secret`, `auth`, `cookie` and their obvious relatives. A match is replaced, not removed, so you can still see that the field was there.

The JavaScript client also strips a list of query parameters out of URLs, `token` and `access_token` and `api_key` among them, because a URL ends up in a breadcrumb and a breadcrumb ends up in a report.

## Adding your own

Laravel, in `config/larabug.php`:

```php config/larabug.php
'blacklist' => [
    'password',
    'password_confirmation',
    'iban',
    'national_insurance_number',
],
```

JavaScript, at `init`:

```js
init({
  dsn: import.meta.env.VITE_LARABUG_DSN,
  blacklist: ['iban', 'national_insurance_number'],
  urlBlacklist: ['invite_code'],
})
```

Both lists are merged with the defaults rather than replacing them, and both match case insensitively on a substring, so `iban` also covers `customer_iban`.

## The user block

The most personal thing in a report is usually the user, and by default the Laravel client sends the whole model. One method fixes it:

```php app/Models/User.php
use LaraBug\Concerns\Larabugable;

class User extends Authenticatable implements Larabugable
{
    public function toLarabug(): array
    {
        return ['id' => $this->id];
    }
}
```

In the browser, pass a `user` you have chosen rather than one you have to hand.

## The last word

The JavaScript client gives you the event itself before it goes:

```js
init({
  dsn: import.meta.env.VITE_LARABUG_DSN,
  beforeSend: (event) => {
    if (event.request?.url?.includes('/admin')) {
      return null
    }

    return event
  },
})
```

Return `null` and nothing is sent. Return the event, changed however you like, and that is what arrives.

## What you cannot filter

Your own context. Anything you pass to `LaraBug::handle($e, 'php', [...])` or `captureException(error, {...})` is sent as given: the blacklist covers the fields the client collected, not the ones you added. Put an order id in there, not an address.