A HAR is a fired artifact plus PII

Treat it as a password dump

A HAR is JSON of every request the page made: collector hits, your XHR, cookies, Authorization, POST bodies. It is a fired artifact, not a template. It is also a session. Share it like a password dump. Prefer staging HARs. Prefer a redacted list of collector URLs. Never commit a live HAR from production.

Pixel debugging needs the collector requests. It does not need /api/me, billing XHR, or the session cookie. If the ticket still contains your session cookie, it is a live login sitting in the vendor's inbox. The same file often contains CAPI JSON your page never sent and also contains the password reset POST the shopper just made. Filter first. Then redact. Then attach.

Sanitize before attach

1. Keep facebook.com/tr, /g/collect, TikTok, Pinterest, LinkedIn, Floodlight, Adobe, ads conversion hosts. 2. Strip your-origin XHR. 3. Strip cookies that are not _fbp / _ga / the click id cookies you are debugging. 4. Replace emails and phone numbers. 5. Strip Authorization and Cookie headers for your app. Then attach.

Copy as cURL of a single collector request is usually enough. Run pixellint validate url on that URL after redaction. Paste the linter output, not the cookie jar. For CAPI, paste a redacted JSON fixture (event_name, event_time, event_id, hashed em shape) and pixellint validate json. Never both a raw HAR and a raw cURL of the same session in one ticket.

pixellint validate url @redacted-collect.txt --rulepack vendor/google-analytics-collect
pixellint validate url @redacted-tr.txt --rulepack vendor/meta

State: fired, not template

HAR URLs have fired. Validate them as fired (default). Macros in a HAR mean the ad server failed to expand, not that you grabbed a template. [CACHEBUSTER] or ${GDPR_CONSENT_...} still sitting in a captured Floodlight tag is a live undercount or a live non-consent.

Template fixtures in CI use --state template so unexpanded macros and empty slots are legal. Do not mark a HAR as template to silence those findings. That hides the bug the HAR was meant to show.

Retention

Delete the file from Slack later. Later never comes. Use a ticket system with expiry, or staging only. Do not email HARs to an agency alias with twenty people on it. Do not drop them in a public issue tracker.

If a HAR with a production session already shipped, rotate the session, treat exposed PII as a leak, and stop asking for unsanitized HARs in the runbook. Put the sanitizing steps in the support macro so the default ask is a redacted collect URL, not a full export.

What to collect instead

Collector URL, request method, status, and a redacted query. For CAPI, a redacted JSON fixture (event_name, event_time, event_id, hashed em shape, no raw email). pixellint validate json on that fixture. Event Match Quality screenshot if the question is matching, not schema.

Pixellint is not affiliated with Chrome or the vendors. The CLI never needs your HAR cookies. Give it the URL or the JSON.

Check the artifact

Paste the pixel URL or JSON body into the playground. Same engine as pixellint validate. Nothing leaves the tab.