Recognised session-recording provider reference in page code or resource markup
ShipReady found a recognised session-recording provider signature in the static page evidence it inspects.
Why it matters
Session-recording products can be configured to collect interaction or page-content data. A recognised provider reference is a useful reason to confirm the integration is intentional and review its deployed configuration.
How ShipReady detects it
What it inspects
ShipReady reads fetch-bearing HTML attributes and executable inline script or style content from the fetched page. It looks for signatures for Hotjar, FullStory, LogRocket, Microsoft Clarity, Mouseflow, and Smartlook.
What triggers a finding
The rule triggers when one or more of those recognised provider signatures appears in the inspected static evidence. A signature found before an HTML truncation point can still trigger the rule.
What the evidence shows
The evidence proves that ShipReady found a recognised session-recording provider signature in static page evidence, and names the matched provider or providers.
Limits of this check
ShipReady does not fetch or execute the provider resource. It does not prove a recording ran, that any data was captured or transmitted, or that masking, redaction, consent, or other runtime settings are enabled or disabled. Ordinary prose, links, code samples, JSON-LD, and non-executable scripts are excluded from this check.
How to fix it
Confirm the integration is intentional
Identify where the reported provider is added and whether it is needed on this page.
Review the deployed provider settings
Review the provider's configuration for the data your product intends to collect, including any masking or redaction controls relevant to your forms and page content.
Review loading conditions
Check when the provider loads in a real browser and make its loading behavior match the product's intended privacy and consent design.
How to verify the change
Verify the deployed integration in a controlled browser session
Use browser developer tools and the provider configuration to review whether and when the integration loads, then test the settings your product relies on.
Expected: The provider is either removed or its observed runtime behavior and configuration match the product's intended design.