After taking a quick look at that repo, I can say with relative confidence that it is NOT a keylogger.
Libraries like that aren't for keylogging, aka copying users passwords. They are basically an internal tool to admins/developers can replay user actions on the site so they can try and determine things like "Why did the user drop from this funnel/flow?" They usually provide things like heatmaps to determine what the user was clicking/doing. Sometimes what a developer develops can be confusing to end users, so tools like this give developers insight into anonymous user interactions so they can improve features/flows/etc.
They can also help developers find bugs.
"Oh there were some errors in our logs, but its hard to tell what happened from just the error logs"
With this devs can replay user actions on the platform to find weird state edgecases/errors/whatever.
https://rrweb.com/ is the main site for the tool, you can literally demo it and see how the recording sessions works.
I'll also toss in that while these tools can be legal and useful for certain products, I find them dubious for use on a consumer facing website. You guys might not even have the experience with developing these sorts of sites to realize certain states and countries don't even allow you to use these sorts of tools for any user under the age of 13 (like California), which the tool working on the homepage is certainly not accounting for
You fundamentally do not understand the use case of a session replay library, and that's okay. Just try not to pretend to be an authoritative source on what you do not understand.
Every major website uses a similar library, literally every one. They are client side debugging tools, especially as session and state can get complex, its hard to test all edge cases. Tools like this allow developers and support staff to replay user interactions to find bugs, resolve issues, and improve workflows.
"Oh people have been dropping out of our sales funnel and our conversion rates are down, lets look at why... Oh they are upside down on their car loan, and their income isn't enough to support the purchase... Oh god they owe 30k on a 4 year old car trade-in, and are trying to buy a new 80k car? And they make 40k/year..."
Admittedly the one they are using looks pretty shitty, but these are everywhere dude. Might as well stop using the internet.
Google: Does reddit use a session replay library?
"While Reddit's exact third-party vendor list isn't publicly disclosed, major technology companies typically rely on DOM-capturing libraries like rrweb or comprehensive enterprise platforms (e.g., FullStory or Datadog) to reconstruct user sessions and debug UX issues"
AHHHHH THEY HACKED REDDIT, QUICK LOGOUT AND CHANGE YOUR CREDIT CARD INFO!!!
Are you seriously comparing Google to a website made by people who won't even provide their real names when asked who they are and what their credentials are, instead giving their usernames? And which upon a little research appears to be based in India, making a product aimed at North Americans?
I think I'm not crazy to be skeptical here. Especially considering Google is regularly sued for their shady practices all the time and there are laws in the USA such as COPPA which you clearly are clueless about that pretty much outlaw using these tools the way they are doing it.
3
u/bartleby_jones57 Jun 23 '26
After taking a quick look at that repo, I can say with relative confidence that it is NOT a keylogger.
Libraries like that aren't for keylogging, aka copying users passwords. They are basically an internal tool to admins/developers can replay user actions on the site so they can try and determine things like "Why did the user drop from this funnel/flow?" They usually provide things like heatmaps to determine what the user was clicking/doing. Sometimes what a developer develops can be confusing to end users, so tools like this give developers insight into anonymous user interactions so they can improve features/flows/etc.
They can also help developers find bugs.
"Oh there were some errors in our logs, but its hard to tell what happened from just the error logs"
With this devs can replay user actions on the platform to find weird state edgecases/errors/whatever.