Forensics

Forensics are the evidence Hud captures when something goes wrong in a flow. Hud counts every call all the time, but collects forensics mainly on an error or a significant performance spike, so the evidence is already there before anyone asks for it.

When Hud captures forensics

• On an error, for example when an endpoint returns a 5xx or a function throws.
• On a significant duration spike, when a request takes far longer than its normal. What counts as significant is configurable.

Hud limits how many forensics each process captures, so a burst of the same error leaves a few examples rather than one per request. The Python SDK also captures forensics from a small sample of successful requests as a baseline, about 2 a minute plus one for each new flow.

What forensics include

By default, forensics include:

• The call graph of the functions Hud tracked during the request.
• The request's route, its path and query parameters, and its body. Request headers aren't captured, apart from trace IDs.
• The function that threw, and the exception: its type, message and stack trace.
• Metadata about outbound calls, for supported frameworks.
• Any custom context you set on the flow, such as a customer ID.

Function parameters are off by default. When Hud turns them on for an account, the Node.js SDK records the arguments of the functions an exception passed through. The Java and Python SDKs don't capture them. Each detail can be turned on or off independently. Contact Hud to change what your forensics collect.

Each Node.js forensic also includes the host name and machine ID of the pod it came from. To leave specific fields out, contact Hud.

Hud keeps forensics for 30 days by default. To keep them longer, talk to your account manager.

Privacy

Hud scrubs sensitive data inside your service, before any forensics are sent. It redacts values by key name (such as password, token or email) and by pattern, and a redacted value shows as [REDACTED]. Unscrubbed data never leaves your service. Metrics, which Hud collects all the time, contain no PII. See Security and PII for the full rules.

Where to find forensics

• In the web app: the forensics panel on service, endpoint and function pages, and the forensics on each issue, including the full forensics view. You can filter forensics by session.
• In your coding agent: through Hud MCP, so the agent can read the evidence while it works on a fix.