Datadog Real User Monitoring

The `datadoghq-browser-agent` script host in the markup.

The `DD_RUM` global, used to initialise the agent.

Requests to `browser-intake-datadoghq` hosts, where the agent sends its data.

Any one match reports the browser integration; infrastructure monitoring by Datadog is never inferred from it.

Datadog's key documentation states that, for security reasons, API keys cannot be used to send data from a browser, mobile or TV app, as they would be exposed client-side.

End-user-facing applications use client tokens instead, and the documentation lists browser log collection and RUM among the clients that need one.

A client token visible in the page is therefore expected, and it is not reported as a leaked secret.

An API key found in front-end code would be a different matter, and credential checks report those.

The agent measures the experience of actual visitors — page loads, interactions, errors — from their browsers.

That is visitor data sent to a third party, which is why RUM belongs in a site's privacy notice and, where required, in its consent management.

Session replay, if enabled, records visitor sessions; its privacy options are configured in the agent and are not visible from outside.

The agent is a third-party script with its own weight and position in the page.

It can tell that the agent loads on the pages crawled.

It cannot tell the sampling rate, whether session replay is on, or which privacy level is configured.

It cannot see Datadog infrastructure, APM or log monitoring, which the check says explicitly.

No data is ever sent to the intake.

`monitoring.datadog` reports the browser agent when detected, and not verifiable otherwise.

`monitoring.summary` places it among the other public monitoring signals.

`exposure.secrets.private` reports private credentials found in served code, which a client token is not.

`performance.third_party_resources` measures what the agent adds to the page.

Datadog's documentation says client tokens are unique to the organisation and are managed from the organisation settings.

It notes that when the user who created a client token is deactivated, the token remains active — a detail worth knowing when someone leaves the team that set up monitoring.

A client token is removed by deleting it, and unlike a revoked API key it cannot be restored afterwards.

Removing a token stops every page still configured with it from reporting, so replacing it means updating the agent configuration first.

The token value is not reported by the audit; the detection is enough to say the agent is present.

The RUM Browser SDK's advanced configuration describes a `beforeSend` callback that receives every event the SDK collects before it is sent to Datadog.

The callback can modify an event — redacting a query string from a URL, for example — or discard it by returning `false`.

That is where a site keeps personal data out of the events, and it is configured in code the audit does not see.

What the audit can report is that the SDK loads, which is the fact that makes the configuration question worth asking.