From 12f8b83ef4670f2161acf0b95be50b67237f9d90 Mon Sep 17 00:00:00 2001
From: luke-belton <luke.b@posthog.com>
Date: Wed, 26 Nov 2025 11:00:49 +0000
Subject: [PATCH 1/2] refactor sensitive data capture

---
 .../src/__tests__/autocapture-utils.test.ts   | 157 ++++++++----------
 .../browser/src/__tests__/autocapture.test.ts | 102 +++++++++---
 packages/browser/src/autocapture-utils.ts     |  71 +++-----
 packages/browser/src/autocapture.ts           |  22 +--
 4 files changed, 181 insertions(+), 171 deletions(-)

diff --git a/packages/browser/src/__tests__/autocapture-utils.test.ts b/packages/browser/src/__tests__/autocapture-utils.test.ts
index 0049cd2e3f..631af23091 100644
--- a/packages/browser/src/__tests__/autocapture-utils.test.ts
+++ b/packages/browser/src/__tests__/autocapture-utils.test.ts
@@ -1,11 +1,8 @@
 /// <reference lib="dom" />
 
-import sinon from 'sinon'
-
 import {
     getSafeText,
-    shouldCaptureDomEvent,
-    shouldCaptureElement,
+    shouldAutocaptureEvent,
     isSensitiveElement,
     shouldCaptureValue,
     isAngularStyleAttr,
@@ -14,6 +11,8 @@ import {
     getElementsChainString,
     getClassNames,
     makeSafeText,
+    isExplicitNoCapture,
+    isExplicitCapture,
 } from '../autocapture-utils'
 import { document } from '../utils/globals'
 import { makeMouseEvent } from './autocapture.test'
@@ -121,6 +120,30 @@ describe(`Autocapture utility functions`, () => {
             el.innerHTML = `Mixed "double" and 'single' quotes`
             expect(getSafeText(el)).toBe(`Mixed "double" and 'single' quotes`)
         })
+
+        it(`should collect text from sensitive elements with ph-include class`, () => {
+            const input = document!.createElement(`input`)
+            input.className = `ph-include`
+            input.appendChild(document.createTextNode(`Hello world`))
+            document!.body.appendChild(input)
+            expect(getSafeText(input)).toBe(`Hello world`)
+        })
+
+        it(`shouldn't collect text from elements with ph-no-capture class`, () => {
+            const el = document!.createElement(`div`)
+            el.className = `ph-no-capture`
+            el.innerHTML = `Hello world`
+            document!.body.appendChild(el)
+            expect(getSafeText(el)).toBe(``)
+        })
+
+        it(`shouldn't collect text from elements with ph-sensitive class`, () => {
+            const el = document!.createElement(`div`)
+            el.className = `ph-sensitive`
+            el.innerHTML = `Hello world`
+            document!.body.appendChild(el)
+            expect(getSafeText(el)).toBe(``)
+        })
     })
 
     describe(`makeSafeText`, () => {
@@ -175,7 +198,7 @@ describe(`Autocapture utility functions`, () => {
     describe(`shouldCaptureDomEvent`, () => {
         it(`should capture "submit" events on <form> elements`, () => {
             expect(
-                shouldCaptureDomEvent(document!.createElement(`form`), {
+                shouldAutocaptureEvent(document!.createElement(`form`), {
                     type: `submit`,
                 } as unknown as Event)
             ).toBe(true)
@@ -183,14 +206,14 @@ describe(`Autocapture utility functions`, () => {
 
         it.each([`input`, `SELECT`, `textarea`])(`should capture "change" events on <%s> elements`, (tagName) => {
             expect(
-                shouldCaptureDomEvent(document!.createElement(tagName), {
+                shouldAutocaptureEvent(document!.createElement(tagName), {
                     type: `change`,
                 } as unknown as Event)
             ).toBe(true)
         })
 
         it.each([`A`, `a`])(`should capture "click" events on <%s> elements`, (tagName) => {
-            expect(shouldCaptureDomEvent(document!.createElement(tagName), makeMouseEvent({}))).toBe(true)
+            expect(shouldAutocaptureEvent(document!.createElement(tagName), makeMouseEvent({}))).toBe(true)
         })
 
         it(`should capture "click" events on <button> elements`, () => {
@@ -200,22 +223,22 @@ describe(`Autocapture utility functions`, () => {
             const button3 = document!.createElement(`input`)
             button3.setAttribute(`type`, `submit`)
             ;[button1, button2, button3].forEach((button) => {
-                expect(shouldCaptureDomEvent(button, makeMouseEvent({}))).toBe(true)
+                expect(shouldAutocaptureEvent(button, makeMouseEvent({}))).toBe(true)
             })
         })
 
         it(`should protect against bad inputs`, () => {
-            expect(shouldCaptureDomEvent(null as unknown as Element, makeMouseEvent({}))).toBe(false)
-            expect(shouldCaptureDomEvent(undefined as unknown as Element, makeMouseEvent({}))).toBe(false)
-            expect(shouldCaptureDomEvent(`div` as unknown as Element, makeMouseEvent({}))).toBe(false)
+            expect(shouldAutocaptureEvent(null as unknown as Element, makeMouseEvent({}))).toBe(false)
+            expect(shouldAutocaptureEvent(undefined as unknown as Element, makeMouseEvent({}))).toBe(false)
+            expect(shouldAutocaptureEvent(`div` as unknown as Element, makeMouseEvent({}))).toBe(false)
         })
 
         it(`should NOT capture "click" events on <form> elements`, () => {
-            expect(shouldCaptureDomEvent(document!.createElement(`form`), makeMouseEvent({}))).toBe(false)
+            expect(shouldAutocaptureEvent(document!.createElement(`form`), makeMouseEvent({}))).toBe(false)
         })
 
         it.each([`html`, 'body'])(`should NOT capture "click" events on <%s> elements`, (tagName) => {
-            expect(shouldCaptureDomEvent(document!.createElement(tagName), makeMouseEvent({}))).toBe(false)
+            expect(shouldAutocaptureEvent(document!.createElement(tagName), makeMouseEvent({}))).toBe(false)
         })
 
         describe('css selector allowlist', () => {
@@ -317,7 +340,7 @@ describe(`Autocapture utility functions`, () => {
                 ],
             ])('correctly respects the allow list: %s', (_, clickTarget, autoCaptureConfig, shouldCapture) => {
                 expect(
-                    shouldCaptureDomEvent(clickTarget, makeMouseEvent({}), autoCaptureConfig as AutocaptureConfig)
+                    shouldAutocaptureEvent(clickTarget, makeMouseEvent({}), autoCaptureConfig as AutocaptureConfig)
                 ).toBe(shouldCapture)
             })
         })
@@ -348,110 +371,64 @@ describe(`Autocapture utility functions`, () => {
         })
     })
 
-    describe(`shouldCaptureElement`, () => {
+    describe(`isExplicitCapture`, () => {
+        it(`should return true for elements with class "ph-include"`, () => {
+            const el = document!.createElement(`div`)
+            el.className = `test1 ph-include test2`
+            expect(isExplicitCapture(el)).toBe(true)
+        })
+
+        it(`should return false for elements without class "ph-include"`, () => {
+            const el = document!.createElement(`div`)
+            el.className = `test1 test2`
+            expect(isExplicitCapture(el)).toBe(false)
+        })
+    })
+
+    describe(`isExplicitNoCapture`, () => {
         let el: HTMLDivElement
-        let input: HTMLInputElement
         let parent1: HTMLDivElement
         let parent2: HTMLDivElement
 
         beforeEach(() => {
             el = document!.createElement(`div`)
-            input = document!.createElement(`input`)
             parent1 = document!.createElement(`div`)
             parent2 = document!.createElement(`div`)
             parent1.appendChild(el)
-            parent1.appendChild(input)
             parent2.appendChild(parent1)
             document!.body.appendChild(parent2)
         })
 
-        it(`should include sensitive elements with class "ph-include"`, () => {
-            el.className = `test1 ph-include test2`
-            expect(shouldCaptureElement(el)).toBe(true)
-        })
-
-        it(`should never include inputs with class "ph-sensitive"`, () => {
+        it(`should return true for elements with class "ph-sensitive"`, () => {
             el.className = `test1 ph-include ph-sensitive test2`
-            expect(shouldCaptureElement(el)).toBe(false)
+            expect(isExplicitNoCapture(el)).toBe(true)
         })
 
-        it(`should not include elements with class "ph-no-capture" as properties`, () => {
+        it(`should return true for elements with class "ph-no-capture"`, () => {
             el.className = `test1 ph-no-capture test2`
-            expect(shouldCaptureElement(el)).toBe(false)
+            expect(isExplicitNoCapture(el)).toBe(true)
         })
 
-        it(`should not include elements with a parent that have class "ph-no-capture" as properties`, () => {
-            expect(shouldCaptureElement(el)).toBe(true)
+        it(`should return true for elements with a parent that has class "ph-no-capture"`, () => {
+            expect(isExplicitNoCapture(el)).toBe(false)
 
             parent2.className = `ph-no-capture`
 
-            expect(shouldCaptureElement(el)).toBe(false)
+            expect(isExplicitNoCapture(el)).toBe(true)
         })
+    })
 
-        it(`should not include hidden fields`, () => {
+    describe(`isSensitiveElement - hidden and password inputs`, () => {
+        it(`should return true for hidden fields`, () => {
+            const input = document!.createElement(`input`)
             input.type = `hidden`
-            expect(shouldCaptureElement(input)).toBe(false)
+            expect(isSensitiveElement(input)).toBe(true)
         })
 
-        it(`should not include password fields`, () => {
+        it(`should return true for password fields`, () => {
+            const input = document!.createElement(`input`)
             input.type = `password`
-            expect(shouldCaptureElement(input)).toBe(false)
-        })
-
-        it(`should not include fields with sensitive names`, () => {
-            const sensitiveNames = [
-                `cc_name`,
-                `card-num`,
-                `ccnum`,
-                `credit-card_number`,
-                `credit_card[number]`,
-                `csc num`,
-                `CVC`,
-                `Expiration`,
-                `password`,
-                `pwd`,
-                `routing`,
-                `routing-number`,
-                `security code`,
-                `seccode`,
-                `security number`,
-                `social sec`,
-                `SsN`,
-            ]
-            sensitiveNames.forEach((name) => {
-                input.name = ''
-                expect(shouldCaptureElement(input)).toBe(true)
-
-                input.name = name
-                expect(shouldCaptureElement(input)).toBe(false)
-            })
-        })
-
-        // See https://github.com/posthog/posthog-js/issues/165
-        // Under specific circumstances a bug caused .replace to be called on a DOM element
-        // instead of a string, removing the element from the page. Ensure this issue is mitigated.
-        it(`shouldn't inadvertently replace DOM nodes`, () => {
-            // setup
-            ;(el as any).replace = sinon.spy()
-
-            // test
-            input.name = el as any
-            shouldCaptureElement(parent1) // previously this would cause el.replace to be called
-            expect((el as any).replace.called).toBe(false)
-            input.name = ''
-
-            parent1.id = el as any
-            shouldCaptureElement(parent2) // previously this would cause el.replace to be called
-            expect((el as any).replace.called).toBe(false)
-            parent1.id = ''
-
-            input.type = el as any
-            shouldCaptureElement(parent2) // previously this would cause el.replace to be called
-            expect((el as any).replace.called).toBe(false)
-            input.type = ''
-
-            // cleanup
-            ;(el as any).replace = undefined
+            expect(isSensitiveElement(input)).toBe(true)
         })
     })
 
diff --git a/packages/browser/src/__tests__/autocapture.test.ts b/packages/browser/src/__tests__/autocapture.test.ts
index 3d53499087..54e4e71430 100644
--- a/packages/browser/src/__tests__/autocapture.test.ts
+++ b/packages/browser/src/__tests__/autocapture.test.ts
@@ -8,7 +8,7 @@ import {
     getPropertiesFromElement,
     previousElementSibling,
 } from '../autocapture'
-import { shouldCaptureDomEvent } from '../autocapture-utils'
+import { shouldAutocaptureEvent } from '../autocapture-utils'
 import { AUTOCAPTURE_DISABLED_SERVER_SIDE } from '../constants'
 import { AutocaptureConfig, FlagsResponse, PostHogConfig, RageclickConfig } from '../types'
 import { PostHog } from '../posthog-core'
@@ -232,6 +232,7 @@ describe('Autocapture system', () => {
         let div2: HTMLDivElement
         let input: HTMLInputElement
         let sensitiveInput: HTMLInputElement
+        let noCaptureInput: HTMLInputElement
         let hidden: HTMLInputElement
         let password: HTMLInputElement
 
@@ -253,6 +254,14 @@ describe('Autocapture system', () => {
             sensitiveInput.setAttribute('data-ph-capture-attribute-on-the-sensitive-input', 'is on the sensitive-input')
             sensitiveInput.className = 'ph-sensitive'
 
+            noCaptureInput = document.createElement('input')
+            noCaptureInput.value = 'test val'
+            noCaptureInput.setAttribute(
+                'data-ph-capture-attribute-on-the-no-capture-input',
+                'is on the no-capture-input'
+            )
+            noCaptureInput.className = 'ph-no-capture'
+
             hidden = document.createElement('input')
             hidden.setAttribute('type', 'hidden')
             hidden.setAttribute('data-ph-capture-attribute-on-the-hidden', 'is on the hidden')
@@ -273,6 +282,7 @@ describe('Autocapture system', () => {
             div2.appendChild(div)
             div2.appendChild(input)
             div2.appendChild(sensitiveInput)
+            div2.appendChild(noCaptureInput)
             div2.appendChild(hidden)
             div2.appendChild(password)
         })
@@ -292,22 +302,28 @@ describe('Autocapture system', () => {
             expect(props['on-the-input']).toBe('is on the input')
         })
 
-        it('should collect augment from input with class "ph-sensitive"', () => {
+        it('should not collect augment from input with class "ph-sensitive"', () => {
             const props = getAugmentPropertiesFromElement(sensitiveInput)
 
-            expect(props['on-the-sensitive-input']).toBeUndefined()
+            expect(props).toStrictEqual({})
         })
 
-        it('should not collect augment from the hidden element value', () => {
-            const props = getAugmentPropertiesFromElement(hidden)
+        it('should not collect augment from input with class "ph-no-capture"', () => {
+            const props = getAugmentPropertiesFromElement(noCaptureInput)
 
             expect(props).toStrictEqual({})
         })
 
+        it('should collect augment from the hidden element value', () => {
+            const props = getAugmentPropertiesFromElement(hidden)
+
+            expect(props).toStrictEqual({ 'on-the-hidden': 'is on the hidden' })
+        })
+
         it('should collect augment from the password element value', () => {
             const props = getAugmentPropertiesFromElement(password)
 
-            expect(props).toStrictEqual({})
+            expect(props).toStrictEqual({ 'on-the-password': 'is on the password' })
         })
     })
 
@@ -866,6 +882,49 @@ describe('Autocapture system', () => {
             expect(beforeSendMock.mock.calls[0][0].properties['$elements'][0]).not.toHaveProperty('attr__href')
         })
 
+        it.each([
+            ['password', 'Reset password'],
+            ['ccnum', 'Update card'],
+            ['ssn-field', 'Social security'],
+        ])(
+            'captures href and text content from anchors with IDs containing sensitive substrings like %s',
+            (id, textContent) => {
+                // this is a test to prove some earlier behavior where we would've blocked
+                // capture for elements like this.
+                const elAnchor = document.createElement('a')
+                elAnchor.setAttribute('id', id)
+                elAnchor.setAttribute('href', 'https://example.com')
+                elAnchor.textContent = textContent
+                document.body.appendChild(elAnchor)
+
+                autocapture['_captureEvent'](
+                    makeMouseEvent({
+                        target: elAnchor,
+                    })
+                )
+
+                const properties = beforeSendMock.mock.calls[0][0].properties
+                expect(properties['$elements'][0]).toHaveProperty('attr__href', 'https://example.com')
+                expect(properties['$el_text']).toBe(textContent)
+            }
+        )
+
+        it.each(['ph-no-capture', 'ph-sensitive'])('does not capture event from anchors with %s class', (className) => {
+            const elAnchor = document.createElement('a')
+            elAnchor.classList.add(className)
+            elAnchor.setAttribute('href', 'https://example.com')
+            elAnchor.textContent = 'Click here'
+            document.body.appendChild(elAnchor)
+
+            autocapture['_captureEvent'](
+                makeMouseEvent({
+                    target: elAnchor,
+                })
+            )
+
+            expect(beforeSendMock).not.toHaveBeenCalled()
+        })
+
         it('correctly identifies and formats text content', () => {
             document.body.innerHTML = `
       <div>
@@ -1024,6 +1083,7 @@ describe('Autocapture system', () => {
             const a = document.createElement('a')
             const span = document.createElement('span')
             a.appendChild(span)
+            document.body.appendChild(a)
             autocapture['_captureEvent'](makeMouseEvent({ target: a }))
             expect(beforeSendMock).toHaveBeenCalledTimes(1)
 
@@ -1267,10 +1327,10 @@ describe('Autocapture system', () => {
 
             window!.location = new URL('https://posthog.com/test/matching') as unknown as string & Location
 
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(true)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(true)
 
             window!.location = new URL('https://posthog.com/docs/not-matching') as unknown as string & Location
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(false)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(false)
         })
 
         it('not capture urls which match the url regex ignorelist', () => {
@@ -1288,10 +1348,10 @@ describe('Autocapture system', () => {
 
             window!.location = new URL('https://posthog.com/test/matching') as unknown as string & Location
 
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(false)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(false)
 
             window!.location = new URL('https://posthog.com/docs/not-matching') as unknown as string & Location
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(true)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(true)
         })
 
         it('an empty url regex allowlist does not match any url', () => {
@@ -1309,7 +1369,7 @@ describe('Autocapture system', () => {
 
             window!.location = new URL('https://posthog.com/test/captured') as unknown as string & Location
 
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(false)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(false)
         })
 
         it('only capture event types which match the allowlist', () => {
@@ -1324,12 +1384,12 @@ describe('Autocapture system', () => {
             const autocapture_config: AutocaptureConfig = {
                 dom_event_allowlist: ['click'],
             }
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(true)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(true)
 
             const autocapture_config_change: AutocaptureConfig = {
                 dom_event_allowlist: ['change'],
             }
-            expect(shouldCaptureDomEvent(button, e, autocapture_config_change)).toBe(false)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config_change)).toBe(false)
         })
 
         it('an empty event type allowlist matches no events', () => {
@@ -1344,7 +1404,7 @@ describe('Autocapture system', () => {
             const autocapture_config = {
                 dom_event_allowlist: [],
             }
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(false)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(false)
         })
 
         it('only capture elements which match the allowlist', () => {
@@ -1359,12 +1419,12 @@ describe('Autocapture system', () => {
             const autocapture_config: AutocaptureConfig = {
                 element_allowlist: ['button'],
             }
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(true)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(true)
 
             const autocapture_config_change: AutocaptureConfig = {
                 element_allowlist: ['a'],
             }
-            expect(shouldCaptureDomEvent(button, e, autocapture_config_change)).toBe(false)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config_change)).toBe(false)
         })
 
         it('an empty event allowlist means we capture no elements', () => {
@@ -1379,7 +1439,7 @@ describe('Autocapture system', () => {
             const autocapture_config: AutocaptureConfig = {
                 element_allowlist: [],
             }
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(false)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(false)
         })
 
         it('only capture elements which match the css allowlist', () => {
@@ -1395,12 +1455,12 @@ describe('Autocapture system', () => {
             const autocapture_config: AutocaptureConfig = {
                 css_selector_allowlist: ['[data-track="yes"]'],
             }
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(true)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(true)
 
             const autocapture_config_change = {
                 css_selector_allowlist: ['[data-track="no"]'],
             }
-            expect(shouldCaptureDomEvent(button, e, autocapture_config_change)).toBe(false)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config_change)).toBe(false)
         })
 
         it('an empty css selector list captures no elements', () => {
@@ -1416,7 +1476,7 @@ describe('Autocapture system', () => {
             const autocapture_config: AutocaptureConfig = {
                 css_selector_allowlist: [],
             }
-            expect(shouldCaptureDomEvent(button, e, autocapture_config)).toBe(false)
+            expect(shouldAutocaptureEvent(button, e, autocapture_config)).toBe(false)
         })
 
         it('If a user sets dom_event_allowlist and element_allowlist with css_selector_allowlist it us a union so only the dom events on the element allow list with the css selector', () => {
@@ -1449,7 +1509,7 @@ describe('Autocapture system', () => {
                     })
 
                     // check if we allow capture only as a union of allowlists
-                    expect(shouldCaptureDomEvent(element, fakeEvent, autocapture_config)).toBe(expectedCapturable)
+                    expect(shouldAutocaptureEvent(element, fakeEvent, autocapture_config)).toBe(expectedCapturable)
                 })
             })
         })
diff --git a/packages/browser/src/autocapture-utils.ts b/packages/browser/src/autocapture-utils.ts
index e4aa38b8dc..b4cbaedb0d 100644
--- a/packages/browser/src/autocapture-utils.ts
+++ b/packages/browser/src/autocapture-utils.ts
@@ -73,7 +73,11 @@ export function makeSafeText(s: string | null | undefined): string | null {
 export function getSafeText(el: Element): string {
     let elText = ''
 
-    if (shouldCaptureElement(el) && !isSensitiveElement(el) && el.childNodes && el.childNodes.length) {
+    if (
+        (isExplicitCapture(el) || (!isExplicitNoCapture(el) && !isSensitiveElement(el))) &&
+        el.childNodes &&
+        el.childNodes.length
+    ) {
         each(el.childNodes, function (child) {
             if (isTextNode(child) && child.textContent) {
                 elText += makeSafeText(child.textContent) ?? ''
@@ -262,8 +266,7 @@ const getElementAndParentsForElement = (el: Element, captureOnAnyElement: false
 }
 
 /*
- * Check whether a DOM event should be "captured" or if it may contain sensitive data
- * using a variety of heuristics.
+ * Check whether a DOM event should be "captured" using a variety of heuristics.
  * @param {Element} el - element to check
  * @param {Event} event - event to check
  * @param {Object} autocaptureConfig - autocapture config
@@ -271,7 +274,7 @@ const getElementAndParentsForElement = (el: Element, captureOnAnyElement: false
  * @param {string[]} allowedEventTypes - event types to capture, normally just 'click', but some autocapture types react to different events, some elements have fixed events (e.g., form has "submit")
  * @returns {boolean} whether the event should be captured
  */
-export function shouldCaptureDomEvent(
+export function shouldAutocaptureEvent(
     el: Element,
     event: Event,
     autocaptureConfig: AutocaptureConfig | undefined = undefined,
@@ -338,56 +341,35 @@ export function shouldCaptureDomEvent(
 }
 
 /*
- * Check whether a DOM element should be "captured" or if it may contain sensitive data
- * using a variety of heuristics.
+ * Check whether an element or its parents have been explicitly marked to not capture.
+ * Looks for 'ph-sensitive' or 'ph-no-capture' classes.
  * @param {Element} el - element to check
- * @returns {boolean} whether the element should be captured
+ * @returns {boolean} whether the element is marked as no-capture
  */
-export function shouldCaptureElement(el: Element): boolean {
+export function isExplicitNoCapture(el: Element): boolean {
     for (let curEl = el; curEl.parentNode && !isTag(curEl, 'body'); curEl = curEl.parentNode as Element) {
         const classes = getClassNames(curEl)
         if (includes(classes, 'ph-sensitive') || includes(classes, 'ph-no-capture')) {
-            return false
-        }
-    }
-
-    if (includes(getClassNames(el), 'ph-include')) {
-        return true
-    }
-
-    // don't include hidden or password fields
-    const type = (el as HTMLInputElement).type || ''
-    if (isString(type)) {
-        // it's possible for el.type to be a DOM element if el is a form with a child input[name="type"]
-        switch (type.toLowerCase()) {
-            case 'hidden':
-                return false
-            case 'password':
-                return false
-        }
-    }
-
-    // filter out data from fields that look like sensitive fields
-    const name = (el as HTMLInputElement).name || el.id || ''
-    // See https://github.com/posthog/posthog-js/issues/165
-    // Under specific circumstances a bug caused .replace to be called on a DOM element
-    // instead of a string, removing the element from the page. Ensure this issue is mitigated.
-    if (isString(name)) {
-        // it's possible for el.name or el.id to be a DOM element if el is a form with a child input[name="name"]
-        const sensitiveNameRegex =
-            /^cc|cardnum|ccnum|creditcard|csc|cvc|cvv|exp|pass|pwd|routing|seccode|securitycode|securitynum|socialsec|socsec|ssn/i
-        if (sensitiveNameRegex.test(name.replace(/[^a-zA-Z0-9]/g, ''))) {
-            return false
+            return true
         }
     }
+    return false
+}
 
-    return true
+/*
+ * Check whether an element has been explicitly marked to capture via 'ph-include' class.
+ * @param {Element} el - element to check
+ * @returns {boolean} whether the element is marked for capture
+ */
+export function isExplicitCapture(el: Element): boolean {
+    return includes(getClassNames(el), 'ph-include')
 }
 
 /*
- * Check whether a DOM element is 'sensitive' and we should only capture limited data
+ * Check whether a DOM element is 'sensitive' and we should only capture limited data.
+ * This includes form elements that could contain user input.
  * @param {Element} el - element to check
- * @returns {boolean} whether the element should be captured
+ * @returns {boolean} whether the element is sensitive
  */
 export function isSensitiveElement(el: Element): boolean {
     // don't send data from inputs or similar elements since there will always be
@@ -419,11 +401,10 @@ const anchoredSSNRegex = new RegExp(`^(${coreSSNPattern})$`)
 const unanchoredSSNRegex = new RegExp(`(${coreSSNPattern})`)
 
 /*
- * Check whether a string value should be "captured" or if it may contain sensitive data
- * using a variety of heuristics.
+ * Check whether a string value should be "captured" or if it may contain sensitive data.
  * @param {string} value - string value to check
  * @param {boolean} anchorRegexes - whether to anchor the regexes to the start and end of the string
- * @returns {boolean} whether the element should be captured
+ * @returns {boolean} whether the value should be captured
  */
 export function shouldCaptureValue(value: string, anchorRegexes = true): boolean {
     if (isNullish(value)) {
diff --git a/packages/browser/src/autocapture.ts b/packages/browser/src/autocapture.ts
index a8f5f4de6f..3ce3a9d0b1 100644
--- a/packages/browser/src/autocapture.ts
+++ b/packages/browser/src/autocapture.ts
@@ -7,10 +7,10 @@ import {
     getEventTarget,
     getSafeText,
     isAngularStyleAttr,
+    isExplicitNoCapture,
     isSensitiveElement,
     makeSafeText,
-    shouldCaptureDomEvent,
-    shouldCaptureElement,
+    shouldAutocaptureEvent,
     shouldCaptureRageclick,
     shouldCaptureValue,
     splitClassString,
@@ -26,7 +26,6 @@ import { createLogger } from './utils/logger'
 import { document, window } from './utils/globals'
 import { convertToURL } from './utils/request-utils'
 import { isDocumentFragment, isElementNode, isTag, isTextNode } from './utils/element-utils'
-import { includes } from '@posthog/core'
 
 const logger = createLogger('[AutoCapture]')
 
@@ -38,8 +37,7 @@ function limitText(length: number, text: string): string {
 }
 
 export function getAugmentPropertiesFromElement(elem: Element): Properties {
-    const shouldCaptureEl = shouldCaptureElement(elem)
-    if (!shouldCaptureEl) {
+    if (isExplicitNoCapture(elem)) {
         return {}
     }
 
@@ -169,19 +167,13 @@ export function autocapturePropertiesForElement(
     let explicitNoCapture = false
 
     each(targetElementList, (el) => {
-        const shouldCaptureEl = shouldCaptureElement(el)
-
+        explicitNoCapture = explicitNoCapture || isExplicitNoCapture(el)
         // if the element or a parent element is an anchor tag
         // include the href as a property
         if (el.tagName.toLowerCase() === 'a') {
             href = el.getAttribute('href')
-            href = shouldCaptureEl && href && shouldCaptureValue(href) && href
-        }
-
-        // allow users to programmatically prevent capturing of elements by adding class 'ph-no-capture'
-        const classes = getClassNames(el)
-        if (includes(classes, 'ph-no-capture')) {
-            explicitNoCapture = true
+            // only capture href if element is not marked as no-capture and value is safe
+            href = !explicitNoCapture && href && shouldCaptureValue(href) && href
         }
 
         elementsJson.push(
@@ -367,7 +359,7 @@ export class Autocapture {
         const isCopyAutocapture = eventName === COPY_AUTOCAPTURE_EVENT
         if (
             target &&
-            shouldCaptureDomEvent(
+            shouldAutocaptureEvent(
                 target,
                 e,
                 this._config,

From 37c9e3f81bc7bffd3c0577a32b6a85d4e400b65a Mon Sep 17 00:00:00 2001
From: luke-belton <luke.b@posthog.com>
Date: Thu, 27 Nov 2025 17:41:11 +0000
Subject: [PATCH 2/2] changeset

---
 .changeset/young-clocks-call.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/young-clocks-call.md

diff --git a/.changeset/young-clocks-call.md b/.changeset/young-clocks-call.md
new file mode 100644
index 0000000000..e64b9a5976
--- /dev/null
+++ b/.changeset/young-clocks-call.md
@@ -0,0 +1,5 @@
+---
+'posthog-js': patch
+---
+
+Fix autocapture incorrectly blocking capture from elements with IDs/names containing sensitive looking substrings (e.g., `<a id="password">`). Sensitive data protection is maintained through element type checks and value pattern matching, as well as `ph-no-capture` element attributes.