---
title: Live Debugger Sensitive Data Scrubbing
description: Protect sensitive application data captured by Live Debugger.
breadcrumbs: Docs > APM > Live Debugger > Live Debugger Sensitive Data Scrubbing
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Live Debugger Sensitive Data Scrubbing

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

[Live Debugger](https://docs.datadoghq.com/tracing/live_debugger.md) captures logs and variable snapshots that can contain sensitive application data, especially when using the Capture Variables option.

The following redaction mechanisms help protect captured data:

- **Identifier and type rules** redact matching values in your infrastructure, before upload.
- **Live Debugger redaction modes** control which captured values are visible. See mode-based redaction.
- **Sensitive Data Scanner rules** redact matching data after it reaches Datadog. See Sensitive Data Scanner. These rules are not a substitute for rules that prevent sensitive values from leaving your infrastructure.

## Mode-based redaction{% #mode-based-redaction %}

Live Debugger has two redaction modes:

- Strict Mode: Redacts all values except numbers and Booleans. [Bits Live Debugger](https://docs.datadoghq.com/tracing/live_debugger/bits-live-debugger.md) is not available for service and environment combinations set to Strict Mode.
- Targeted Mode: Redacts known sensitive patterns such as credit card numbers, API keys, IPs, and other PII. It also runs a high-entropy secrets scanner that automatically redacts likely secrets, which appear as `[REDACTED:HIGH_ENTROPY]` in captured data.

These redaction modes cannot be disabled, only switched. Targeted Mode is applied automatically in common pre-production environments such as `staging` or `preprod`. Changing the redaction mode requires the **Live Debugger Redaction Write** permission.

## Redact based on identifiers{% #redact-based-on-identifiers %}

### Default behavior{% #default-behavior %}

Live Debugger automatically redacts values linked to sensitive identifiers, such as `password` and `accessToken`, before captured data leaves the host. Additional language-specific redaction rules are built into each SDK. See [redacted identifiers](https://github.com/DataDog/dd-trace-java/blob/master/dd-java-agent/agent-debugger/debugger-bootstrap/src/main/java/datadog/trace/bootstrap/debugger/util/Redaction.java).

### Custom identifier redaction{% #custom-identifier-redaction %}

You can further tailor redaction by specifying additional identifiers. In your application's environment (not on `datadog-agent`), set the `DD_DYNAMIC_INSTRUMENTATION_REDACTED_IDENTIFIERS` environment variable to a comma-separated list of identifiers such as `firstName,lastName,phoneNumber`.

To exclude specific identifiers from the default redaction list, set the `DD_DYNAMIC_INSTRUMENTATION_REDACTION_EXCLUDED_IDENTIFIERS` environment variable to a comma-separated list of identifiers that should not be redacted, such as `cookie,sessionid`.

Redaction applies universally, regardless of how the identifier is used in the code (as method arguments, local variables, class attributes, dictionary keys, and so on). The associated values are redacted in your infrastructure and not uploaded to Datadog.

## Redact based on specific classes or types{% #redact-based-on-specific-classes-or-types %}

Certain classes may inherently contain sensitive information (for example, a `UserCredentials` class). Again in your application's environment (not on `datadog-agent`), set the `DD_DYNAMIC_INSTRUMENTATION_REDACTED_TYPES` environment variable to a comma-separated list of sensitive types, such as `MyCompany.Authentication.UserCredential,MyCompany.BillingAddress`.

Class-based redaction:

- Redacts variables of the types listed. Their contents are not uploaded to Datadog.
- Stops probes from being set within any code location in the redacted classes.

## Redact based on variable values with Sensitive Data Scanner{% #redact-based-on-variable-values-with-sensitive-data-scanner %}

[Sensitive Data Scanner](https://docs.datadoghq.com/security/sensitive_data_scanner.md) identifies and redacts sensitive information based on specific regular expressions.

### Configure Sensitive Data Scanner rules{% #configure-sensitive-data-scanner-rules %}

Create, customize, or disable rules on the [Sensitive Data Scanner page](https://app.datadoghq.com/organization-settings/sensitive-data-scanner). When creating a rule, set its filter to `source:dd_debugger` to apply it to Live Debugger logs. For configuration instructions, see the [Sensitive Data Scanner documentation](https://docs.datadoghq.com/security/sensitive_data_scanner.md).

**Note**: Datadog Sensitive Data Scanner performs its redaction *after* the information is uploaded to Datadog.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Setting Up Live Debugger](https://docs.datadoghq.com/tracing/live_debugger.md#setup)
- [Sensitive Data Scanner](https://docs.datadoghq.com/security/sensitive_data_scanner.md)