From 5cb23418e1c1cc0108dcdb3976eb3d9177b32c08 Mon Sep 17 00:00:00 2001
From: Ben Senescu <44480372+bensenescu@users.noreply.github.com>
Date: Fri, 21 Aug 2026 17:39:44 -0400
Subject: [PATCH] Mask API key values in PostHog replays (#514)

---
 src/client/features/settings/ApiKeySettings.tsx | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/client/features/settings/ApiKeySettings.tsx b/src/client/features/settings/ApiKeySettings.tsx
index 8357b3a..1448ded 100644
--- a/src/client/features/settings/ApiKeySettings.tsx
+++ b/src/client/features/settings/ApiKeySettings.tsx
@@ -135,7 +135,10 @@ export function ApiKeySettings() {
                   <td className="max-w-[220px] truncate font-medium">
                     {key.name || "Unnamed key"}
                   </td>
-                  <td className="font-mono text-xs text-base-content/70">
+                  <td
+                    className="font-mono text-xs text-base-content/70"
+                    data-ph-mask
+                  >
                     {key.start || "oseo_"}…
                   </td>
                   <td className="text-xs text-base-content/70">
@@ -197,7 +200,10 @@ export function ApiKeySettings() {
                   to <span className="font-mono text-xs">{mcpUrl}</span>.
                 </p>
                 <div className="mt-4 flex items-center gap-2">
-                  <code className="min-w-0 flex-1 overflow-x-auto rounded bg-base-200 px-2.5 py-2 font-mono text-xs">
+                  <code
+                    className="min-w-0 flex-1 overflow-x-auto rounded bg-base-200 px-2.5 py-2 font-mono text-xs"
+                    data-ph-mask
+                  >
                     {createdKey}
                   </code>
                   <CopyButton