When the browser throws, what gets sent

A client-side error is only useful if it survives the page it happened on. Two details matter more than the reporting library.

Transport first. Once a React tree is unwinding, a normal fetch may never finish. The reporter prefers navigator.sendBeacon and falls back to fetch with keepalive. The payload is capped at 8 KB, and the server truncates again — message to 500 characters, stack to 4000, page URL to 500 — so a pathological stack cannot turn an error report into an upload.

Noise second. The same error often fires on every render. The client dedupes by the first 120 characters of the message, remembered in sessionStorage for the session. In private mode sessionStorage may be unavailable, so dedupe is best-effort: the report still goes out rather than being silently dropped. On the server, a per-IP rate limit keeps the endpoint from becoming a log amplifier.

What is not collected: anything typed into a tool. The payload carries message, stack, page URL, user agent and app version. A signed-in report includes the account ID so repeats can be grouped; IPs are stored only as an HMAC and cannot be reversed.

The rule we settled on: an error report may be noisy, but it should never cost more than the error itself.