Is Amplitude Event Explorer safe?
Amplitude Event Explorer intercepts all outgoing browser requests to extract analytics payloads and can activate full DOM session recording on any page.
The extension's service worker reads the body of every outgoing web request across all websites to capture Amplitude analytics event data and API keys from request headers. When test mode is enabled by the user, the content script activates rrweb-based session recording at 100% sample rate, capturing DOM mutations, clicks, and form interactions and transmitting them to Amplitude's servers. The extension also reads Amplitude cookies on startup and can capture full DOM snapshots of any page and proxy them to app.amplitude.com.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Session replay on all pages when test mode is enabled
Opening the popup, enabling Test Mode with session replay on, plus an Amplitude key entered, starts the content script, already in every tab, recording DOM mutations, clicks, form input via rrweb.
Batches go to Amplitude at 100% sample.
You open the extension popup, enter an Amplitude API key, and enable Test Mode with Session Replay turned on.
This sends a popup:setTestModeConfig message to every content script currently injected into open tabs.
The content script on the active tab immediately starts recording everything that happens on the page and sends it to Amplitude.
rrweb captures DOM mutations, clicks, scroll events, and text input at 100% sample rate; recordings are POSTed to api-sr.amplitude.com in gzip-encoded batches.
| Content-Type | application/json |
{"version":1,"events":[<gzip-encoded rrweb event stream>]}Session replay plugin initialization at 100% sample rate
function activateSessionReplay(config) {
if (!hI.instance) return;
if (config.isEnabled && config.enableSessionReplay) {
// sampleRate:1 = 100% of sessions recorded
const replayPlugin = createSessionReplayPlugin({
sampleRate: 1,
storeType: 'memory',
useWebWorker: true
});
hI.instance.add(replayPlugin);
hI.sessionReplayPlugin = replayPlugin;
} else if (hI.sessionReplayPlugin) {
hI.instance.remove(hI.sessionReplayPlugin.name);
hI.sessionReplayPlugin = null;
}
}| Field | Value | Why it matters | |
|---|---|---|---|
DOM mutations | {"type":3,"data":{"source":2,"texts":[{"id":47,"value":"search query text"}]}} | Every change to the page structure, text typed, elements added or removed, modal dialogs opening, is recorded as it happens. | |
Click and input events | {"type":3,"data":{"source":5,"id":102,"x":312,"y":448}} | Mouse clicks and keyboard input on non-password form fields are captured, showing which UI elements you interact with. | |
Scroll position | {"type":3,"data":{"source":3,"x":0,"y":1240}} | Scroll depth and viewport position are recorded throughout the session. | |
Page URL | https://en.wikipedia.org/wiki/Main_Page | The URL of the page being recorded is included in each session batch sent to Amplitude. |
- api-sr.amplitude.com
Receives rrweb session replay batches. Run by Amplitude, Inc. (acquired by Confluent 2024). Data lands in the Amplitude project tied to the entered API key.
- sr-client-cfg.amplitude.com
Returns per-project privacy masking config (defaultMaskLevel, urlMaskLevels, capture_enabled, sample_rate). Masking depends on the operator's settings.
Session replay only activates when a user with access to the extension popup explicitly enables it, enters a valid Amplitude API key, and toggles Session Replay on. The recording scope is limited to the tab where the content script is active at activation time; however because the content script is injected into all HTTP/S pages (`*://*/*`), any tab can become a recording target. Password, off-screen, file, email, and tel input fields are excluded by the `shouldTrackEventResolver` filter (inject.bundle.js line 60322). Privacy masking beyond that exclusion list depends on the remote config returned by sr-client-cfg.amplitude.com for the specific Amplitude project.