Configure Sentry security settings and data protection.
Use when setting up PII scrubbing, managing sensitive data,
configuring data scrubbing rules, or hardening Sentry for compliance.
Trigger with phrases like "sentry security", "sentry PII",
"sentry data scrubbing", "secure sentry", "sentry GDPR".
Configure Sentry security settings and data protection.
Use when setting up PII scrubbing, managing sensitive data,
configuring data scrubbing rules, or hardening Sentry for compliance.
Trigger with phrases like "sentry security", "sentry PII",
"sentry data scrubbing", "secure sentry", "sentry GDPR".
Designed for Claude Code, also compatible with Codex and OpenClaw
Sentry Security Basics
Overview
Configure Sentry's security posture: PII scrubbing with beforeSend, built-in data scrubbing, IP anonymization, browser SDK URL filtering, DSN vs auth token handling, CSP reporting, and GDPR data deletion. Covers both client-side (SDK) and server-side (dashboard) controls.
Prerequisites
Sentry project created with Owner or Admin role
@sentry/node >= 8.x or @sentry/browser >= 8.x installed (or sentry-sdk >= 2.x for Python)
import re
defbefore_send(event, hint):
# Scrub emails from exception messagesif'exception'in event:
for exc in event['exception'].get('values', []):
if exc.get('value'):
exc['value'] = re.sub(
r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}',
'[EMAIL_REDACTED]',
exc['value']
)
exc['value'] = re.sub(
r'\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b',
'[IP_REDACTED]',
exc['value']
)
# Strip user PIIif'user'in event:
event['user'].pop('email', None)
event['user'].pop('ip_address', None)
# Scrub request headers
request = event.get('request', {})
headers = request.get('headers', {})
for key in ['Authorization', 'Cookie', 'X-Api-Key']:
headers.pop(key, None)
return event
sentry_sdk.init(
dsn=os.environ["SENTRY_DSN"],
send_default_pii=False,
before_send=before_send,
)
Step 4 — Server-Side Data Scrubbing Rules
Configure in Project Settings > Security & Privacy:
Setting
What it does
Data Scrubber
Auto-scrubs fields matching common PII patterns (enabled by default)
Sensitive Fields
Custom field names to always scrub: password, ssn, credit_card_number, api_key, secret, token, authorization
Safe Fields
Fields excluded from scrubbing (e.g., transaction_id, correlation_id)
Scrub IP Addresses
Removes or zeroes IP addresses on all events
Scrub Credit Cards
Detects and removes card number patterns
Organization-wide defaults: Organization Settings > Security & Privacy applies to all projects unless overridden at project level.
Advanced scrubbing rules (regex-based) can target specific event paths:
# Example server-side rules (configure in UI):
# Pattern: [a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}
# Target: $message, $error.value, $extra.**
# Action: Replace with [Filtered]
# Pattern: \b\d{3}-\d{2}-\d{4}\b
# Target: $extra.**, $contexts.**
# Action: Replace with [Filtered] (SSN pattern)
Step 5 — Browser SDK URL Filtering
Use denyUrls and allowUrls to control which scripts generate captured errors:
Sentry.init({
dsn: process.env.SENTRY_DSN,
// Ignore errors from third-party scriptsdenyUrls: [
/extensions\//i, // Browser extensions/^chrome:\/\//i, // Chrome internal/^chrome-extension:\/\//i, // Chrome extensions/^moz-extension:\/\//i, // Firefox extensions/graph\.facebook\.com/i, // Facebook SDK/connect\.facebook\.net/i, // Facebook SDK/cdn\.jsdelivr\.net/i, // CDN-hosted third-party
],
// Only capture errors from your own codeallowUrls: [
/https?:\/\/(www\.)?example\.com/i,
/https?:\/\/staging\.example\.com/i,
],
});
Also configure Allowed Domains in Project Settings > Client Keys (DSN) > Configure to prevent unauthorized origins from sending events to your DSN:
example.com
*.example.com
staging.example.com
Step 6 — CSP Reporting via Sentry
Sentry can ingest Content-Security-Policy violation reports. Use the Security Headers endpoint (not the main DSN):
# Find the report URI in Project Settings > Security Headers
# Format: https://o<org-id>.ingest.us.sentry.io/api/<project-id>/security/?sentry_key=<public-key>
Sentry supports right-to-erasure requests via API:
# Delete a specific issue and all its events
curl -X DELETE \
-H "Authorization: Bearer $SENTRY_AUTH_TOKEN" \
"https://sentry.io/api/0/projects/$SENTRY_ORG/$SENTRY_PROJECT/issues/$ISSUE_ID/"# Delete events by tag (find issues for a specific user first)
curl -H "Authorization: Bearer $SENTRY_AUTH_TOKEN" \
"https://sentry.io/api/0/projects/$SENTRY_ORG/$SENTRY_PROJECT/issues/?query=user.id:$USER_ID" \
| jq '.[].id' \
| xargs -I{} curl -X DELETE \
-H "Authorization: Bearer $SENTRY_AUTH_TOKEN" \
"https://sentry.io/api/0/projects/$SENTRY_ORG/$SENTRY_PROJECT/issues/{}/"
For bulk deletion, use Organization Settings > Data Privacy > Data Removal Requests (Business/Enterprise plans).
Data retention settings: Organization Settings > Subscription > Event Retention — configure 30/60/90-day retention windows to auto-purge old data.
Step 8 — Auth Token Hygiene Checklist
# Scan codebase for leaked auth tokens
grep -rn "sntrys_" --include="*.ts" --include="*.js" --include="*.py" \
--include="*.env*" --include="*.yaml" --include="*.yml" \
--exclude-dir=node_modules --exclude-dir=.git .
# Sentry auth tokens start with "sntrys_" — any match is a leak# If found: revoke immediately at sentry.io/settings/auth-tokens/
Token best practices:
Separate tokens per environment — never share between dev/staging/production
Minimal scopes — project:releases + org:read for CI source map uploads
Set expiration dates — 90 days max for CI tokens
Rotate quarterly — calendar reminder, automate if possible
Audit via API — GET /api/0/api-tokens/ to list all active tokens
Output
After completing these steps you will have:
sendDefaultPii: false set explicitly in SDK init
beforeSend callback stripping emails, IPs, credit cards, auth headers, and tokens from events
Server-side data scrubber enabled with custom sensitive field list
denyUrls / allowUrls filtering out third-party noise in browser projects
Allowed Domains restricting which origins can send events
CSP report-uri configured for security header violation reporting
GDPR deletion workflow documented and tested
Auth tokens stored in CI secrets with minimal scopes and expiration dates
Error Handling
Error
Cause
Solution
PII appears in captured events
sendDefaultPii: true or PII embedded in error messages
Set sendDefaultPii: false; add beforeSend scrubbing for error message patterns
Auth token leaked in repo
Token committed to version control
Revoke at sentry.io/settings/auth-tokens/ immediately; rotate; add sntrys_ pattern to .gitignore and pre-commit hooks
