The roughly 26 KB tracker feeds a full observability stack
The README describes a roughly 26 KB Brotli-compressed tracker, but the server behind it is a broad system. OpenReplay records DOM activity and pairs it with console logs, JavaScript errors, network calls, application state, page-speed data, and CPU or memory signals. Developers can replay a journey with browser evidence beside it. Search and analytics group behavior into reusable segments and filters.
More than 40 metrics appear in the documented DevTools view. Spot records a bug report from a Chrome extension, and Assist adds live viewing plus WebRTC calls. Plugins connect popular app-state and request libraries, including Redux, Vuex, Apollo, and Axios. Sentry, Datadog, CloudWatch, Stackdriver, and Elastic integrations can connect backend evidence. That breadth is the reason to choose OpenReplay over a recording library, and the reason deployment is substantial.
What happened when we ran it
Our sandbox installed 374 Go packages from ./backend/ in 59 seconds. The build then completed successfully in 193 seconds. We used commit 5cf43dd in an unprivileged Debian container with 3 CPUs, 8 GB of RAM, and no secrets. The checkout occupied 51.8 MB and contained 5,751 files with roughly 346,148 source lines. Repository signals included 29 CI workflow files, a Dockerfile, and no top-level tests directory.
Go tests failed after 47 seconds with exit code 1. The summary reported 0 passed and 27 failed out of 27. Every package in the log tail was marked build failed, including geo-IP HTTP code, analytics charts and dashboards, the Assist proxy, jobs, replay services, authentication, session handling, and the Spot transcoder. The tail does not include the compiler messages that caused those failures, so it supports no narrower diagnosis.
The split result matters. A 193-second successful build says the backend can compile through the build command used by our measurement setup. A test command may compile packages under different tags or paths, and here none of its 27 packages passed. The supplied evidence does not say which difference was responsible. Before a pilot, reproduce the test command in the deployment toolchain and obtain the earlier compiler output rather than treating the standalone build as sufficient.
Production starts at 2 vCPUs, 8 GB, and 50 GB
OpenReplay's single-machine guide requires at least 2 vCPUs, 8 GB of RAM, and 50 GB of storage on x86, running Ubuntu Server 24.04 LTS. It also needs a public IP and domain. The Kubernetes path requires version 1.18 or newer and Helm 3.10 or newer, packages PostgreSQL and Redis, and asks multi-node clusters for an RWX volume writable by user ID 1001. Those requirements put it in data-platform territory.
HTTPS is mandatory because the tracker and dashboard will not work without it, according to the deployment guide. Operators must provide DNS and either their own certificate, a cloud load balancer, or a generated certificate. The cluster configuration asks for a PostgreSQL password, object-storage access and secret keys, and a JWT secret. Once the server exists, each instrumented application also needs a project key and the self-hosted ingest URL. Source maps and user metadata add more policy decisions.
More than 40 browser metrics raise the privacy stakes
A replay can contain user interactions, requests, console output, store state, and more than 40 technical metrics. OpenReplay provides controls for choosing what to capture, obscure, or ignore before data reaches the server. Those controls must match the application's sensitive fields, URL shapes, and authentication flow. Keeping data in your own cloud changes custody; it does not remove the need for retention rules, access review, masking tests, or notice to users where law and policy require it.
Custom roles add another boundary. The roles-and-access guide says project-level and feature-level role definitions are available only in the Enterprise edition. Community-edition evaluators should map the access model they actually receive before sending production sessions into the system. The v1.27.0 release added organization API-key rotation and tenant ownership transfer, administrative functions that do not replace granular authorization. Support staff viewing live screens should receive no broader session access than their work requires.
Version v1.27.0 is older than the latest code activity
Release v1.27.0 arrived on May 5, 2026 with reusable segments, replay element tags called Features, analytics breakdowns, tracker changes for iframes and URL sanitization, and backend pipeline work. It also moved the public API from Python to Go and added service health endpoints. GitHub then recorded a repository push on September 3, 2026, so the four-month release gap is not evidence that development stopped. Buyers should test a tagged release rather than mainline unless they need an unreleased fix.
GitHub listed 128 open issues and 51 open pull requests when fetched. Several recently updated pull requests were dependency bumps, while a new code-change pull request was opened and updated on September 3. That is clear maintenance activity alongside a large queue. With 12,655 stars, OpenReplay has wide visibility, though stars do not tell you whether maintainers can resolve a specific recorder, browser, or cluster problem on your schedule. Check relevant issue threads before choosing a rollout date.
AGPL v3 is the default outside named exceptions
AGPL v3 applies by default to content outside the repository's named exceptions. Some directories use MIT terms, third-party components retain their original licenses, and ee/ has a separate license. GitHub therefore reports no single SPDX license for the monorepo. A team that modifies the server or packages enterprise code should have counsel map the directories it will use. Calling the entire project simply MIT or simply AGPL would miss what the top-level license says.
The 374-package backend belongs with teams that already operate stateful infrastructure and can own privacy controls. Highlight is the closer choice when logs and traces drive the purchase; PostHog suits product analytics and experimentation; rrweb is the smaller recording primitive. OpenReplay makes sense when browser debugging, replay search, and self-hosted custody must live together. Our 27 failed test packages make a measured pilot mandatory before production data enters that stack.