The GlitchReplay blog

Back-of-envelope math on rrweb payloads, retention, sample rate, and egress turned into a one-screen estimator.

Convert raw error counts into a 9s-of-availability number — the math, the assumptions, and a one-screen calculator.

A self-audit recipe: pull recent events, run them through a PII detector, compare against your redaction config.

Two ways to feed your GlitchReplay funnel: explicit track() events or the drop-in autocapture tag. When each wins, why running both doesn't double-count, and the hybrid most teams should use.

The cryptic prod-mode minified message decoded into the readable dev-mode message, plus the five most common root causes.

CrUX vs PageSpeed Insights vs Lighthouse — what each measures and when to use which.

Feature, pricing, and SDK compatibility breakdown for the three tools teams most often weigh against each other.

The five most common reasons frames render as `<anonymous>` even after you've uploaded source maps — and the diagnostic checklist that finds the cause in under five minutes.

`unhandledrejection` is necessary but not sufficient. The async stacks, polyfill quirks, and framework integrations you also need.

Replay is amazing for UI bugs and useless for backend race conditions. A decision matrix for picking the right tool per incident class.

A back-of-envelope on rrweb payload sizes at scale, the egress traps in cross-cloud setups, and how flat-rate replay is even possible.

A real war story: an intermittent Stripe failure that only happened on iOS Safari with autofill. Replay closed the loop in 20 minutes.

Source map upload is one of three preconditions. Here are all three, and how to verify each in production.

Build-time upload is faster but couples deploys to your error tracker; runtime fetch is slower but more resilient. Picking one.

The three Vite plugin options that everyone forgets, and what production stack traces look like before vs after each one.

Server-side upload, signed URLs, and the deploy-script hooks that make this a one-time setup instead of a recurring leak risk.

A subtle webpack misconfiguration that silently shipped wrong source maps for two weeks — and the assertion we now run in CI.

Auth-error rate, geo dispersion, and user-agent patterns that distinguish a real attack from a buggy mobile app release.

Annotated time-series from three real incidents we've seen, and the heuristics we use to alert without paging on Black Friday traffic.

How to classify the `/.env`, `/wp-admin`, and `/.git/config` noise — and why you should keep them, not filter them.

The actual payloads landing on production today: query-string injections, CSP-bypass tricks, and the new wave of mutation-XSS.

Tail workers, `console.log` limits, and getting full stack traces out of edge runtime — what works in 2026.

The hanging-promise patterns that trigger it, and the structured-cloning gotcha most people miss.

Three runtimes, three transport stories, one trace ID — how to stitch them together so an incident report doesn't need three dashboards.

A walkthrough of the bundle-too-large, dynamic-import, and `nodejs_compat` flag combinations that bite every Cloudflare Next.js team at least once.

Connection limits, query plan surprises, and the indexes that turn a 30-second query into a 30ms one.

RUM-based alerting that fires on real users, not synthetic monitors — including the percentile choice that actually correlates with revenue.

Postmortem of a quietly-rolled-out CDN config change, how RUM caught it, and the alert rule we now run on every deploy.

Threshold tuning, baseline drift, and the routing rules that send the right alert to the right team — without paging at 3 AM for a country-specific blip.

Annotated replay frames from a real incident. Five minutes from alert to root cause — without ever reproducing it locally.

Why hydration errors are uniquely hard to spot, and the diff between an error tracker that buries them and one that surfaces them.

What we saw, what we did, and the three guardrails we added so it can't happen the same way again.

The four edge cases the migration script missed, the alerting gap that lasted six hours, and the customer-facing communication that worked.

Three real ways client-side scrubbing leaks data — and the threat model that makes server-side a hard requirement.

BAA, masking, audit logs, retention. A non-lawyer's guide to what you have to do, and what your error tracker has to do for you.

URL fragments, request bodies, IP addresses, breadcrumbs — the four places PII enters error data that even careful teams miss.

A self-audit checklist with the regexes we use to find leaks in our own ingest pipeline. Run it against your last 1,000 events.

How to convert raw error counts into a number leadership cares about, without hiring an SRE or installing Datadog.

Benchmarks from 200 teams, broken down by stage and stack. Where the spend goes, and where it's almost always wasted.

A pragmatic SLO definition that uses the data you already have, and the dashboard that makes it visible to the rest of the company.

`handleError` hooks on both client and server, plus the SSR-vs-client error stream split that matters for real triage.

Why island hydration errors look like client errors but actually originate in the build, and how to source-map them.

A map of every place a Remix request can fail, the boundary that catches it, and the breadcrumb that explains why.

Suspense boundaries swallow errors by design. Here's how to surface them without sacrificing the UX they enable.

A walkthrough of CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Framework-specific setup for CSP reporting using middleware, route handlers, and the modern Reporting API.

Use a corpus of existing violation reports to preview what would break before you flip the switch.

An evergreen reference covering violated-directive, blocked-uri, source-file, document-uri, sample, disposition.

A walkthrough of the VLQ-decode pain of reading minified stack traces by hand, then a free tool that does it instantly.

The canonical recipe for instrumenting a Next.js app: install @sentry/react + @glitchreplay/a11y + @glitchreplay/network-probe, drop in instrumentation-client.ts, mount the error boundary, ship.

Drop the test from a GlitchReplay issue into vitest, jest, playwright, or pytest, watch it run red by design, then unmark it once your fix lands.

An honest tour of GlitchReplay, Highlight, Bugsnag, Rollbar, and Datadog Error Tracking — what each one is good at and where each one falls down.

Why we record every session and prune anything not tied to an error after 3 days. Storage math, the late-arriving-error buffer, and why this beats the 30-second pre-error window.

Per-event pricing turns every regression into a billing event. Here's what actually happens, and how flat-rate pricing changes the on-call calculus.

We pulled six months of e-commerce data. The metric most teams obsess over isn't the one with the strongest correlation.

A field guide to the most common violated-directive values, which ones are real attacks, and which ones are just your marketing team adding a pixel.

Step-by-step DSN swap, source-map upload, alert rule mapping, and rollback plan. No code changes beyond a single env var.

App Router, Server Actions, edge runtime, middleware — every place errors hide in modern Next.js, and how to capture them all.

Side-by-side math on per-event vs flat-rate at three traffic tiers. Where each model wins, and the break-even point most teams cross within a year.

`waitUntil`, tail workers, and SDK transport limits — the three things that make Workers error tracking different from Node.

Block-list vs allow-list strategies, the per-attribute exceptions you'll forget about, and the masking tests we run on every release.

Default fingerprints over-group library noise and under-group your real bugs. Here's a fingerprint strategy that mirrors how engineers actually triage.

Inbox-zero for error trackers: the five rules that turn a 10,000-issue backlog into a manageable weekly review.