Your Playwright traces contain your passwords. Scrub them before they leave CI.

Every trace.zip, HAR file, storageState.json and HTML report Playwright writes carries the values your tests typed, the cookies they received and the request bodies they sent. CI secret masking never touches those files. Trace Scrub rewrites them after the run, before they are uploaded anywhere, and gives you a report of what it replaced.

⚠️ This is not a theoretical gap. The Playwright maintainers have declined to build it three times (#19992, 69 upvotes, and again in #35848) and their official advice is to treat every trace and report as a secret. One team wrote that their secret scanners found report leaks "across teams" and that storing secrets in CI artifacts is prohibited by company policy. Another leaked a test account's Google password by following the documented auth setup.

What it does

Unpacks each trace.zip and rewrites .trace, .network and resource files: DOM snapshots, request and response bodies, headers, console entries
Same pass over HAR files, storageState.json (cookies, localStorage) and the HTML report
Replaces the values of the environment variables you name, plus built-in detectors for bearer tokens, JWTs, API keys, session cookies, emails and card numbers
Repacks everything in place, so the Trace Viewer, Currents, BrowserStack and Azure DevOps open it as before
Writes a redaction report: how many values of which kind were replaced, in which files. No secret values in the report, so it can go to an auditor

npx trace-scrub ./test-results --env-secrets E2E_PASSWORD,E2E_TOKEN
# or as a reporter hook, runs onEnd before your upload step

Not in the first release

Screenshots and video (that needs OCR; the text artifacts are where the tokens and cookies live)
Secrets your app logs in altered form (reversed, hashed, re-encoded). This is the exact reason the maintainers refused to ship it as a guarantee. The redaction report exists so you can see what was and was not caught

Pick one

$149

Team licence, 12 months

Unlimited repos and pipelines inside one organisation
CLI + reporter hook + GitHub Action, npm install
Every update for 12 months, then it keeps working at the last version
Your secret names never leave your CI: the tool runs where the traces are

Pay $149

One payment. No subscription. PayPal.

Scrub one trace for me

Send one trace.zip from a failed run (a staging account is fine)
You get it back redacted, plus the report of what was replaced, within 48 hours
No licence, no follow-up. I want to see what real traces leak

Email one trace.zip

Access is dropped once it is done, nothing is kept.

How the paid version works

Pay above, then email ilya.ploskovitov@pii-shield.com from your work address with the organisation name
You get the npm install token and the licence file within 24 hours
Add one line before your artifact upload step. Done

Trace Scrub is best-effort redaction, not a guarantee that no secret survives, and not a substitute for restricting who can download your CI artifacts. It is built on the same detection engine as the open-source pii-shield log redactor. Not affiliated with Microsoft or the Playwright project.