Sentry beforesend scrub secrets

Skill kjuhwa/skills-hub/skills/security/sentry-beforesend-scrub-secrets

Self-correcting knowledge corpus for Claude Code — 9 stable shape clusters, bias-correction pipeline baked into contribution flow. 47 papers, 45 techniques, 1.1k skills.

Install

npx -y skills add kjuhwa/skills-hub --skill sentry-beforesend-scrub-secrets

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Sentry beforeSend hook that strips authorization headers and any breadcrumb data field whose key name looks like a credential (token/key/secret/password/credential/auth) before events leave the client.

SKILL.md

2.8 KB, as published. Nobody here has run it

Scrub secrets in Sentry beforeSend

When to use

Any app reporting errors / breadcrumbs to Sentry (or similar SaaS).
Stack traces and breadcrumbs can carry OAuth tokens, API keys, session cookies.
You need defense in depth — even with careful logging, one console.log(token) in a library can leak.

How it works

Register Sentry.init({ beforeSend(event) { ... return event; } }).
In the hook, walk known high-risk locations:
- event.request?.headers: redact authorization, cookie, x-api-key.
- event.breadcrumbs[].data: for each key, lowercase and check if it contains token, key, secret, password, credential, or auth -> replace value with '[REDACTED]'.
Return the mutated event.
Pair with Sentry.setUser({ id: hashOf(hostname+homedir) }) so you get per-machine uniqueness without PII (never use email/username).
Gate enabled on !!process.env.SENTRY_INGEST_URL so CI builds without the DSN baked in are auto-disabled.

Example

Sentry.init({
  dsn: process.env.SENTRY_DSN,
  enabled: !!process.env.SENTRY_DSN,
  beforeSend(event) {
    for (const h of ['authorization', 'cookie', 'x-api-key']) {
      if (event.request?.headers?.[h]) event.request.headers[h] = '[REDACTED]';
    }
    for (const b of event.breadcrumbs ?? []) {
      for (const k of Object.keys(b.data ?? {})) {
        const lk = k.toLowerCase();
        if (['token','key','secret','password','credential','auth'].some(s => lk.includes(s))) {
          b.data![k] = '[REDACTED]';
        }
      }
    }
    return event;
  },
});
Sentry.setUser({ id: createHash('sha256').update(hostname()+homedir()).digest('hex').slice(0,16) });

Gotchas

This catches the common cases but NOT values embedded in free-form strings (e.g. stack trace message Error: fetch failed for Bearer sk-abc...). Combine with Sentry's server-side PII rules.
Substring match is intentionally aggressive ('auth' in 'authorId' false positive) - that's fine, the scrub is free.
Anonymous machine ID should hash BOTH hostname + homedir so a factory reset still produces a new ID (privacy), but a single user's repeat launches dedupe.