sentry-policy-guardrails

name	sentry-policy-guardrails
description	Enforce organizational governance and policy guardrails for Sentry usage. Use when standardizing Sentry configuration across services, enforcing PII scrubbing, building shared config packages, or auditing drift. Trigger with phrases like "sentry governance", "sentry policy", "sentry standards", "enforce sentry config", "sentry compliance".
allowed-tools	Read, Write, Edit, Grep, Glob, Bash(node:*), Bash(npm:*), Bash(npx:*), Bash(curl:*), Bash(grep:*), Bash(git:*)
version	1.51.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","sentry","compliance","governance","policy","ci","cost-governance"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Sentry Policy Guardrails

Overview

Organizational governance framework that prevents Sentry configuration drift across multiple services. A shared npm package (@company/sentry-config) wraps Sentry.init() to enforce PII scrubbing, naming conventions, tagging standards, and per-tier trace rate caps. CI checks block policy violations before merge, and a monthly drift audit detects projects that have fallen out of compliance.

Prerequisites

• @sentry/node v8+ installed in target services
• Internal npm registry available (GitHub Packages, Artifactory, or similar)
• Team structure and project ownership defined in Sentry
• SENTRY_AUTH_TOKEN with org:read and project:read scopes
• Compliance requirements identified (SOC 2, GDPR, HIPAA)

Instructions

Step 1 — Build the Shared Configuration Package

Create @company/sentry-config that wraps Sentry.init() with non-negotiable defaults.

Mandatory PII scrubbing (cannot be bypassed):

// @company/sentry-config/src/scrubbers.ts
import type { Event } from '@sentry/node';

const SENSITIVE_HEADERS = [
  'authorization', 'cookie', 'set-cookie',
  'x-api-key', 'x-auth-token', 'x-csrf-token',
];

const PII_PATTERNS = [
  { pattern: /\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{1,7}\b/g, replacement: '[CC_REDACTED]' },
  { pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, replacement: '[EMAIL_REDACTED]' },
  { pattern: /\b\d{3}-\d{2}-\d{4}\b/g, :  },
];

  ():  |  {
   (event.?.) {
     ( h  )  event..[h];
  }
   (event.) event. = (event.);
   (event.?.) {
     ( exc  event..) {
       (exc.) exc. = (exc.);
    }
  }
   event;
}

 ():  {
   ( { pattern, replacement }  ) {
    str = str.( (pattern., pattern.), replacement);
  }
   str;
}