·
Last changedVersion:
This version passed the hardening gate. Hardening applied 2 targeted changes and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 0. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 2. Review findings remaining: 10.
2
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/diagnostic-signals.md | Prompt Injection | Direct prompt injection | Medium | Open | |
SKILL.md | Prompt Injection | Direct prompt injection | Medium | Open |
2 findings
When a user asks "why wasn't this session recorded?" or "why don't I have any recordings?", follow this workflow to systematically diagnose the cause.
| Tool | Purpose |
|---|---|
| Query session event properties for diagnostic signals |
| Check if a recording actually exists for the session |
| Search for recordings matching criteria |
The PostHog SDK emits diagnostic properties on every event that explain the recording state. See the diagnostic signals reference for the full list.
The key signals are:
$has_recording — whether PostHog has a stored recording for this session$recording_status — SDK state: active, buffering, disabled, sampled, paused$session_recording_start_reason — why recording started or didn't$sdk_debug_recording_script_not_loaded — recorder script blocked (ad blocker)$sdk_debug_replay_*_trigger_status — trigger states (URL, event, linked flag)$replay_sample_rate — configured sample rate at capture timeIf the user provides a session ID, first check whether a recording actually exists:
If it returns found: false with reason recording_not_found, no recording exists for this session in the active project.
Proceed to Step 2 to diagnose why.
If it returns recording metadata, the recording exists — the issue is likely UI/filtering, not capture.
Any other error (for example, a missing project or a permission error) is not evidence about the recording.
Query the most recent event for the session to get SDK diagnostic properties:
Use the diagnosis logic reference to interpret the signals. The verdicts in priority order:
$has_recording = true) — recording is captured, issue is elsewhere$sdk_debug_recording_script_not_loaded = true) — browser extension blocking the recorder script from loading$recording_status = 'disabled') — replay turned off in settings or SDK configtrigger_pending, none matched) — recording gated on trigger that never fired$session_recording_start_reason = 'sampled_out') — excluded by sample rate$recording_status = 'buffering', buffer length = 0, nothing flushed) — initialized but no snapshots producedflushed_size stays at 0) — snapshots are produced but the /s/ ingestion endpoint is blocked by an ad blocker or misconfigured reverse proxy. Detecting this requires querying the trend across the session's events — see example 3 in examples.mdWhen the user asks about recordings missing project-wide (no specific session), query for recent sessions to check the pattern:
Look for patterns:
disabled → replay is turned off in project settingssampled_out with low sample rate → sample rate too aggressivescript_not_loaded → likely a CSP or deployment issue, not just one user's ad blockerBased on the verdict, recommend specific actions:
| Verdict | Recommendation |
|---|---|
Ad blocked | User's browser extension is blocking rrweb. Suggest using a proxy/custom domain for the recorder script |
Disabled | Check project replay settings — recording may be turned off. Link to Settings > Session replay |
Trigger pending | The configured trigger (URL pattern, event, or feature flag) never matched. Review trigger configuration |
Sampled out | Increase the sample rate in project settings, or use a trigger to guarantee capture for important sessions |
Buffering empty | Page closed before first snapshot. Common with very short sessions or single-page navigations. Consider lowering minimum duration |
Unknown | Direct user to troubleshooting docs: https://posthog.com/docs/session-replay/troubleshooting |
See real-world diagnostic examples showing how signal combinations map to verdicts. Use these to calibrate your interpretation of query results.
$lib_version is very old, some diagnostic signals won't be present.
Note this to the user — upgrading the SDK will provide better diagnostics.$has_recording is true but the user can't find it, check if it's filtered out
by duration, activity threshold, or playlist filters.diagnosing-sdk-health — an outdated SDK is a common root cause and blunts the diagnostic signalsfinding-sessions-to-watch — once capture works, pick the sessions worth watchinginvestigating-replay — analyze the recording once it existsGet started with chainctlchainctl skill install public/posthog/diagnosing-missing-recordings:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/posthog/skills/omnibus/diagnosing-missing-recordings:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/diagnosis-logic.md
references/diagnostic-signals.md
references/examples.md