01
Inspect the capture before it becomes reusable.
Treat the saved application context as something to review, with exclusions visible alongside the useful state.
Inspect the state boundary.
ScenarioDeck is designed for reviewable local-first application state. The point is not to move everything; it is to make the useful context explicit before you reopen it.
Before reuse
InspectCaptured context
ExcludeMaterial outside the boundary
OpenCurrent localhost
Portable state, not portable secrets.
Inspect what is captured. Know what is excluded. Sensitive values are excluded by default; a supported protected value is retained only when you explicitly choose it, only through an OS-protected machine-local boundary, and only with your explicit authorization on each reproduction run.
Review is part of the workflow.
The State Card should make a developer's starting point easier to reason about, not hide its boundary behind a black box.
02
Credentials stay separate by default.
Sensitive values are excluded by default. Retaining a supported protected value is an explicit local choice, and ordinary sharing stays unavailable while a reproduction still requires it. Discard it instead, and the Journey gains a manual barrier for the missing step.
03
Bring the bug to localhost — not production access.
The product is built around local development work and explicit dependency policy, not access to a customer's production system.
What stays outside an ordinary State Capsule.
The capture boundary is deliberate. A useful saved setup is not an export of every browser or authentication detail around it, and a retained protected value never leaves your device through an ordinary share.
Authorization, Cookie, and API key headers, raw cookies, access or refresh tokens, full browser profiles, other tabs/history, and file-upload bodies stay outside an ordinary State Capsule unless you explicitly retain a supported protected value locally.
In replay, the captured source origin is blocked and an unmatched in-scope request fails closed.
Read the current Beta scopeThe website has a boundary too.
Public marketing pages do not require a ScenarioDeck account. The browser is never the authority for a future purchase or entitlement.
Browser inputUntrusted until verified.
Portable stateReviewed before reuse.
Future commerceServer-verified when enabled.
Useful state deserves a visible boundary.
Security is a set of explicit constraints and review points. Keep the useful context close to local development, and know where it stops.
See the local-first workflow