Inspect recorded pixel requests locally from a HAR file.

Treat it as a password dump

A HAR is JSON of every request the page made: collector hits, your XHR, cookies, Authorization, POST bodies. It is a fired artifact, not a template. It is also a session. Share it like a password dump. Prefer staging HARs. Prefer a redacted list of collector URLs. Never commit a live HAR from production.

Pixel debugging needs the collector requests. It does not need /api/me, billing XHR, or the session cookie. If the ticket still contains your session cookie, it is a live login sitting in the vendor's inbox. The same file often contains CAPI JSON your page never sent and also contains the password reset POST the shopper just made. Filter first. Then redact. Then attach.

Sanitize before attach

1. Keep facebook.com/tr, /g/collect, TikTok, Pinterest, LinkedIn, Floodlight, Adobe, ads conversion hosts. 2. Strip your-origin XHR. 3. Strip cookies that are not _fbp / _ga / the click id cookies you are debugging. 4. Replace emails and phone numbers. 5. Strip Authorization and Cookie headers for your app. Then attach.

Copy as cURL of a single collector request is usually enough. Run pixellint validate url on that URL after redaction. Paste the linter output, not the cookie jar. For CAPI, paste a redacted JSON fixture (event_name, event_time, event_id, hashed em shape) and pixellint validate json. Never both a raw HAR and a raw cURL of the same session in one ticket.

pixellint validate url @redacted-collect.txt --rulepack vendor/google-analytics-collect
pixellint validate url @redacted-tr.txt --rulepack vendor/meta

Validate the recorded requests locally.

Pixellint 0.35 imports HAR 1.2 requests directly. Select HAR capture in the playground and import a local file, or use pixellint validate-har in the CLI. Validation inspects recorded requests without resending them to destination vendors. Browser HAR and HTTP captures stay local and skip the sample-upload, saved-history and share-link paths.

The default header policy treats omitted Authorization and Cookie headers as unknown. Use chrome_sanitized for a Chrome export that omitted sensitive headers. Use complete only when the capture establishes that missing headers were absent on the request. These policies preserve capture uncertainty; they do not remove sensitive values from the archive or generated report.

Each request uses its recorded startedDateTime for time-dependent checks. Missing or invalid capture times require an explicit --at Unix-time override. An override applies to every request in the archive. Unsupported bodies and unavailable headers defer dependent checks while visible method, query and header violations still run.

pixellint import-har @capture.har --har-headers chrome_sanitized --json
pixellint validate-har @capture.har --har-headers chrome_sanitized --json
pixellint validate-har @capture.har --at 1791547200 --json

Captured requests use the fired expansion state.

HAR URLs have fired. Validate them as fired (default). Macros in a HAR mean the ad server failed to expand, not that you grabbed a template. [CACHEBUSTER] or ${GDPR_CONSENT_...} still sitting in a captured Floodlight tag is a live undercount or a live non-consent.

Template fixtures in CI use --state template so unexpanded macros and empty slots are legal. Do not mark a HAR as template to silence those findings. That hides the bug the HAR was meant to show.

Retention

Delete the file from Slack later. Later never comes. Use a ticket system with expiry, or staging only. Do not email HARs to an agency alias with twenty people on it. Do not drop them in a public issue tracker.

If a HAR with a production session already shipped, rotate the session, treat exposed PII as a leak, and stop asking for unsanitized HARs in the runbook. Put the sanitizing steps in the support macro so the default ask is a redacted collect URL, not a full export.

What to collect instead

Collector URL, request method, status, and a redacted query. For CAPI, a redacted JSON fixture (event_name, event_time, event_id, hashed em shape, no raw email). pixellint validate json on that fixture. Event Match Quality screenshot if the question is matching, not schema.

For transport checks, extract one sanitized request into the complete request envelope: url, method, headers and an optional raw string body. Run pixellint validate request on that envelope. It preserves multipart text framing and the difference between decoded form data and JSON. Redacted or unsupported content remains a limit of observation.

Pixellint is not affiliated with Chrome or the vendors. The CLI does not need production session cookies. Supply only the sanitized fields necessary for the destination contract under review.

Check the artifact

Paste the pixel URL or JSON body into the playground. Same engine as pixellint validate. Artifacts you test may be stored; see privacy.