Skip to main content ホーム クリエイター jeremylongshore tons-of-skills-marketplace sentry-policy-guardrails
sentry-policy-guardrails Enforce organizational governance and policy guardrails for Sentry usage.
Use when standardizing Sentry configuration across services, enforcing
PII scrubbing, building shared config packages, or auditing drift.
Trigger with phrases like "sentry governance", "sentry policy",
"sentry standards", "enforce sentry config", "sentry compliance".
インストールへ移動 Skills Marketplace コミュニティが作成したAIスキルを発見・探索
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/jeremylongshore/tons-of-skills-marketplace --skill sentry-policy-guardrailsコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Zipをダウンロード ダウンロード中... このリポジトリの他の Skills langchain-deploy-integration Deploy a LangChain 1.0 / LangGraph 1.0 app to Cloud Run, Vercel, or LangServe correctly — with timeouts sized for chain length, cold-start mitigation, SSE anti-buffering headers, and Secret Manager over .env. Use when prepping a first production deploy, debugging a stream that hangs behind a proxy, or diagnosing p99 latency spikes. Trigger with "langchain deploy", "langchain cloud run", "langchain vercel python", "langchain langserve", or "langchain docker".
langchain-langgraph-agents Build a correct LangGraph 1.0 ReAct agent with create_react_agent — typed tools, error propagation, recursion caps, and stop conditions that actually stop. Use when writing a first tool-calling agent, migrating from AgentExecutor or initialize_agent, or diagnosing an agent that loops on vague prompts. Trigger with "langgraph agent", "create_react_agent", "langgraph tool calling", "AgentExecutor migration", or "agent loop cost".
langchain-langgraph-human-in-loop Build LangGraph 1.0 human-in-the-loop approval flows with interrupt_before /
interrupt_after and Command(resume=...) — JSON-serializable state, clean
resume semantics, and UI wiring for approval decisions. Use when adding an
approval gate before an expensive tool call, wiring a Slack/web UI for agent
approvals, or debugging a graph that crashes on interrupt.
Trigger with "langgraph human in loop", "langgraph interrupt_before",
"langgraph approval flow", "Command resume", "langgraph HITL".
name sentry-policy-guardrails description Enforce organizational governance and policy guardrails for Sentry usage.
Use when standardizing Sentry configuration across services, enforcing
PII scrubbing, building shared config packages, or auditing drift.
Trigger with phrases like "sentry governance", "sentry policy",
"sentry standards", "enforce sentry config", "sentry compliance".
allowed-tools Read, Write, Edit, Grep, Glob, Bash(node:*), Bash(npm:*), Bash(npx:*), Bash(curl:*), Bash(grep:*), Bash(git:*) version 1.51.0 license MIT author Jeremy Longshore <jeremy@intentsolutions.io> tags ["saas","sentry","compliance","governance","policy","ci","cost-governance"] compatibility Designed for Claude Code
Sentry Policy Guardrails
Overview
Organizational governance framework that prevents Sentry configuration drift across multiple services. A shared npm package (@company/sentry-config) wraps Sentry.init() to enforce PII scrubbing, naming conventions, tagging standards, and per-tier trace rate caps. CI checks block policy violations before merge, and a monthly drift audit detects projects that have fallen out of compliance.
Prerequisites
@sentry/node v8+ installed in target servicesInternal npm registry available (GitHub Packages, Artifactory, or similar)
Team structure and project ownership defined in Sentry
SENTRY_AUTH_TOKEN with org:read and project:read scopesCompliance requirements identified (SOC 2, GDPR, HIPAA)
Instructions
Step 1 — Build the Shared Configuration Package
Create @company/sentry-config that wraps Sentry.init() with non-negotiable defaults.
Mandatory PII scrubbing (cannot be bypassed):
import type { Event } from '@sentry/node' ;
const SENSITIVE_HEADERS = [
'authorization' , 'cookie' , 'set-cookie' ,
'x-api-key' , 'x-auth-token' , 'x-csrf-token' ,
];
const PII_PATTERNS = [
{ pattern : /\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{1,7}\b/g , replacement : '[CC_REDACTED]' },
{ pattern : /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g , replacement : '[EMAIL_REDACTED]' },
{ pattern : /\b\d{3}-\d{2}-\d{4}\b/g , replacement
'[SSN_REDACTED]'
export
function
scrubEvent
event : Event
Event
null
if
request
headers
for
const
of
SENSITIVE_HEADERS
delete
request
headers
if
message
message
scrubPII
message
if
exception
values
for
const
of
exception
values
if
value
value
scrubPII
value
return
function
scrubPII
str : string
string
for
const
of
PII_PATTERNS
replace
new
RegExp
source
flags
return
Governed init with naming validation, tag injection, and tier-based caps:
import * as Sentry from '@sentry/node' ;
import { scrubEvent } from './scrubbers' ;
const ENFORCED : Partial <Sentry .NodeOptions > = {
sendDefaultPii : false ,
debug : false ,
maxBreadcrumbs : 50 ,
sampleRate : 1.0 ,
maxValueLength : 500 ,
};
const VALID_ENVS = ['production' , 'staging' , 'development' , 'canary' , 'sandbox' ];
const TIER_TRACE_CAPS : Record <string , number > = { critical : 0.5 , standard : 0.2 , internal : 0.05 };
interface PolicyOptions {
serviceName : string ;
dsn : string ;
version : string ;
tags : { service : string ; team : string ; tier : 'critical' | 'standard' | 'internal' };
environment ?: string ;
tracesSampleRate ?: number ;
beforeSend ?: Sentry .NodeOptions ['beforeSend' ];
}
export function initSentry (opts : PolicyOptions void {
if (!opts.dsn ) throw new Error ('@company/sentry-config: dsn required' );
if (!/^[a-z][a-z0-9-]{2,39}$/ .test (opts.serviceName )) {
throw new Error (`Invalid service name "${opts.serviceName} " — use lowercase kebab-case, 3-40 chars` );
}
const env = (opts.environment || process.env .NODE_ENV || 'development' ).toLowerCase ();
if (!VALID_ENVS .includes (env)) {
throw new Error (`Invalid environment "${env} ". Allowed: ${VALID_ENVS.join(', ' )} ` );
}
const tierCap = TIER_TRACE_CAPS [opts.tags .tier ] ?? 0.2 ;
const sha = (process.env .GIT_SHA || process.env .COMMIT_SHA || '' ).substring (0 , 7 );
const release = sha
? `${opts.serviceName} @${opts.version} +${sha} `
: `${opts.serviceName} @${opts.version} ` ;
Sentry .init ({
dsn : opts.dsn ,
environment : env,
release,
serverName : opts.serviceName ,
...ENFORCED ,
debug : env !== 'production' ,
tracesSampleRate : Math .min (opts.tracesSampleRate ?? 0.1 , tierCap),
beforeSend (event, hint ) {
const scrubbed = scrubEvent (event);
if (!scrubbed) return null ;
return opts.beforeSend ? (opts.beforeSend as Function )(scrubbed, hint) : scrubbed;
},
initialScope : {
tags : {
service : opts.tags .service ,
team : opts.tags .team ,
tier : opts.tags .tier ,
deployment : process.env .DEPLOYMENT_ID || 'unknown' ,
region : process.env .AWS_REGION || process.env .GCP_REGION || 'unknown' ,
},
},
});
}
Service usage (two lines to adopt):
import { initSentry } from '@company/sentry-config' ;
initSentry ({
serviceName : 'payments-api' ,
dsn : process.env .SENTRY_DSN !,
version : '2.4.1' ,
tags : { service : 'payments-api' , team : 'payments' , tier : 'critical' },
});
Step 2 — Enforce Compliance via CI Add a GitHub Actions workflow to every service repository that blocks policy violations.
name: Sentry Policy Check
on: [pull_request ]
jobs:
sentry-compliance:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Block hardcoded DSNs
run: |
if grep -rn "https://[a-f0-9]*@.*ingest.*sentry" \
--include="*.ts" --include="*.js" \
--exclude-dir=node_modules --exclude-dir=dist src/; then
echo "::error::Hardcoded Sentry DSN — use SENTRY_DSN env var"
exit 1
fi
- name: Block sendDefaultPii true
run: |
if grep -rn "sendDefaultPii.*true" \
--include="*.ts" --include="*.js" \
--exclude-dir=node_modules src/; then
echo "::error::sendDefaultPii must be false"
exit 1
fi
- name: Block direct Sentry.init calls
run: |
HITS=$(grep -rn "Sentry\.init(" --include="*.ts" --include="*.js" \
--exclude-dir=node_modules --exclude="*sentry-config*" src/ || true)
if [ -n "$HITS" ]; then
echo "::error::Use initSentry() from @company/sentry-config"
echo "$HITS"
exit 1
fi
- name: Verify shared config dependency
run: |
if ! grep -q "@company/sentry-config" package.json; then
echo "::warning::Not using shared Sentry config package"
fi
Optional ESLint rule for IDE feedback:
module .exports = {
meta : { type : 'problem' , messages : { bad : 'Use initSentry() from @company/sentry-config' } },
create (ctx ) {
return {
CallExpression (node) {
if (node.callee .type === 'MemberExpression' &&
node.callee .object .name === 'Sentry' &&
node.callee .property .name === 'init' &&
!ctx.getFilename ().includes ('sentry-config' )) {
ctx.report ({ node, messageId : 'bad' });
}
},
};
},
};
Step 3 — Drift Detection and Cost Governance Monthly drift audit across all Sentry projects:
#!/bin/bash
set -euo pipefail
ORG="${SENTRY_ORG:?required} " TOKEN="${SENTRY_AUTH_TOKEN:?required} "
API="https://sentry.io/api/0"
VIOLATIONS=0
echo "=== Sentry Drift Audit — $(date -u +%Y-%m-%d) ==="
PROJECTS=$(curl -s -H "Authorization: Bearer $TOKEN " \
"$API /organizations/$ORG /projects/?all_projects=1" \
| python3 -c "import json,sys; [print(p['slug']) for p in json.load(sys.stdin)]" )
for P in $PROJECTS ; do
echo "--- $P ---"
curl -s -H "Authorization: Bearer $TOKEN " "$API /projects/$ORG /$P /" \
| python3 -c "
import json, sys, re
p = json.load(sys.stdin)
fails = 0
for label, val in [
('Data Scrubber', p.get('dataScrubber', False)),
('IP Scrubbing', p.get('scrubIPAddresses', False)),
('Naming', bool(re.match(r'^[a-z]+-[a-z0-9]+-[a-z]+$', p['slug']))),
]:
status = 'PASS' if val else 'FAIL'
print(f' [{status}] {label}')
if not val: fails += 1
missing = [f for f in ['password','ssn','credit_card','api_key','secret']
if f not in p.get('sensitiveFields', [])]
if missing:
print(f' [FAIL] Sensitive Fields: missing {missing}')
fails += 1
else:
print(f' [PASS] Sensitive Fields')
sys.exit(1 if fails else 0)
" || VIOLATIONS=$((VIOLATIONS + 1 ))
done
echo ""
echo "Projects with violations: $VIOLATIONS / $(echo "$PROJECTS " | wc -l) "
[ "$VIOLATIONS " -eq 0 ] && echo "STATUS: ALL COMPLIANT" || { echo "STATUS: DRIFT DETECTED" ; exit 1; }
Per-team cost quotas (run weekly):
const QUOTAS = [
{ team : 'payments' , errors : 10_000 , transactions : 50_000 },
{ team : 'platform' , errors : 20_000 , transactions : 100_000 },
{ team : 'growth' , errors : 15_000 , transactions : 200_000 },
{ team : 'infrastructure' , errors : 8_000 , transactions : 20_000 },
];
async function main (const org = process.env .SENTRY_ORG !, token = process.env .SENTRY_AUTH_TOKEN !;
const headers = { Authorization : `Bearer ${token} ` };
const stats = await fetch (
`https://sentry.io/api/0/organizations/${org} /stats_v2/?` +
'field=sum(quantity)&groupBy=project&groupBy=category&interval=1d&statsPeriod=30d' ,
{ headers },
).then (r =>json ()) as any ;
const projects = await fetch (
`https://sentry.io/api/0/organizations/${org} /projects/?all_projects=1` ,
{ headers },
).then (r =>json ()) as any [];
const teamOf = new Map (projects.map ((p : any [p.slug , p.teams ?.[0 ]?.slug || 'unknown' ]));
const usage = new Map <string , { errors : number ; txns : number }>();
for (const g of stats.groups || []) {
const team = teamOf.get (g.by .project ) || 'unknown' ;
if (!usage.has (team)) usage.set (team, { errors : 0 , txns : 0 });
const u = usage.get (team)!;
if (g.by .category === 'error' ) u.errors += g.totals ['sum(quantity)' ];
if (g.by .category === 'transaction' ) u.txns += g.totals ['sum(quantity)' ];
}
let overBudget = false ;
for (const q of QUOTAS ) {
const u = usage.get (q.team ) || { errors : 0 , txns : 0 };
const ePct = ((u.errors / q.errors ) * 100 ).toFixed (0 );
const tPct = ((u.txns / q.transactions ) * 100 ).toFixed (0 );
const flag = u.errors > q.errors || u.txns > q.transactions ? 'OVER' : 'OK' ;
console .log (`[${q.team} ] errors=${u.errors} /${q.errors} (${ePct} %) txns=${u.txns} /${q.transactions} (${tPct} %) [${flag} ]` );
if (flag === 'OVER' ) overBudget = true ;
}
if (overBudget) { console .error ('ACTION REQUIRED: budget exceeded' ); process.exit (1 ); }
}
main ();
name: Sentry Monthly Audit
on:
schedule: [{ cron: '0 9 1 * *' }]
workflow_dispatch:
jobs:
drift:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: bash scripts/audit-sentry-drift.sh
env:
SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
cost:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with: { node-version: '20' }
- run: npx tsx scripts/check-team-quotas.ts
env:
SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
Output
@company/sentry-config shared package with enforced PII scrubbing, naming validation, and tier-based trace rate capsMandatory beforeSend chain: headers, credit cards, emails, and SSNs scrubbed before any custom logic
Naming standards enforced at init: release format, validated environments, kebab-case service names
Required tags injected: service, team, tier, deployment, region
CI workflow blocking hardcoded DSNs, PII collection, and direct Sentry.init() calls
Monthly drift audit checking data scrubber, IP scrubbing, sensitive fields, and naming compliance
Per-team cost quota enforcement with weekly budget checks
Error Handling Error Cause Solution Invalid service name at initName not kebab-case or wrong length Rename to lowercase kebab-case, 3-40 chars, letter start Invalid environment at initNon-standard environment string Use: production, staging, development, canary, or sandbox CI blocks Sentry.init() Direct call outside shared config Replace with initSentry() from @company/sentry-config CI blocks hardcoded DSN DSN string in source code Move to SENTRY_DSN environment variable Drift audit [FAIL] on data scrubber Project settings changed in UI Re-enable in Project Settings then Security and Privacy Team over budget Noisy errors or high trace volume Add ignoreErrors filters or lower tracesSampleRate beforeSend scrubbing bypassedService using raw Sentry.init() Adopt @company/sentry-config which chains scrubbing first
Examples import { initSentry } from '@company/sentry-config' ;
initSentry ({
serviceName : 'user-service' ,
dsn : process.env .SENTRY_DSN !,
version : '1.0.0' ,
tags : { service : 'user-service' , team : 'platform' , tier : 'standard' },
});
Critical service with custom filtering:
import { initSentry } from '@company/sentry-config' ;
initSentry ({
serviceName : 'checkout-api' ,
dsn : process.env .SENTRY_DSN !,
version : '3.2.0' ,
tags : { service : 'checkout-api' , team : 'payments' , tier : 'critical' },
tracesSampleRate : 0.4 ,
beforeSend (event ) {
if (event.exception ?.values ?.some (e =>value ?.includes ('PaymentTimeout' ))) {
return null ;
}
return event;
},
});
Resources
Next Steps
Publish @company/sentry-config to internal registry and onboard first two services
Add the CI policy workflow to all service repositories via shared workflow or template
Schedule the drift audit as a monthly cron and cost check as weekly
Communicate per-team quotas to engineering leads with Slack budget alerts
