When support asks for a HAR file, the request sounds harmless: reproduce the bug, export a log, attach it to a ticket.

But a HAR is not just a performance trace. It can be a snapshot of an authenticated browser session.

Depending on the page and workflow, it may contain:



Authorization headers and API keys
session cookies, including values...