feat(scrubbing): implement PII scrubbing for stacktrace args by solnic · Pull Request #1068 · getsentry/sentry-elixir

solnic · 2026-05-25T11:31:06Z

Sensitive data captured in a FunctionClauseError/Phoenix.ActionClauseError
could leak into Sentry through stacktrace frame variables and the captured
exception's :args

Changes

New Sentry.Scrubber.StacktraceScrubber — a small, framework-agnostic helper
that scrubs args captured into error data. Each arg goes through
Sentry.Scrubber.scrub/1; callers that know the args' shape can pass a custom
callback.
Sentry.Event now scrubs stacktrace frame vars (via scrub_args/1) before
inspecting/truncating them.
Sentry.PlugCapture routes Phoenix.ActionClauseError scrubbing through the
same Sentry.Scrubber as Sentry.PlugContext (honoring the configured
:body_scrubber / :header_scrubber / :cookie_scrubber / :url_scrubber), and
mirrors the scrubbed conn's params onto the action's standalone params arg so both
are redacted consistently.

New reusable exception stacktrace scrubber

This is used under the hood to reduce duplication in Sentry.Event and Sentry.PlugCapture.

Sentry.Scrubber.StacktraceScrubber.scrub(exception)

# Pass a callback to customize scrubbing
scrubbed =
  Sentry.Scrubber.StacktraceScrubber.scrub(exception, fn args ->
    Enum.map(args, &my_scrub/1)
  end)

solnic · 2026-06-03T13:40:34Z


  Otherwise, we don't perform any scrubbing. To configure scrubbing, you can use the
-  `:scrubbing` option (see below).
+  `:scrubber` option (see below).


Yes, that's the correct one 😄

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 587cfb4. Configure here.}

Frame vars in event payloads are built by `inspect/1`-ing each arg, so a Plug.Conn or plain map passed to a function that raises leaks its contents into the event - authorization headers, cookies, password params, etc. `Sentry.Event` now scrubs each frame arg with `Sentry.Scrubber.scrub/1` before inspecting it, redacting `Plug.Conn` and map values (honoring any registered conn scrubber) while leaving everything else untouched. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

This unifies dealing with exceptions and scrubbing. Previously it would special-case function clause errors from phoenix which was not sufficient. Now we scrub plug conn consistently when reporting exceptions.

Add a Phoenix integration endpoint that fabricates a plain FunctionClauseError (not a Phoenix.ActionClauseError) and assert that its captured stacktrace frame vars are scrubbed by Sentry.Event via StacktraceScrubber, independently of PlugCapture's ActionClauseError handling. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

changes in master surfaced this but it will be restored in the follow-up scrubb-broadening branch

sentry-warden Bot reviewed May 25, 2026

View reviewed changes

Comment thread lib/sentry/scrubber.ex Outdated

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch 2 times, most recently from a1fa0b9 to ad495d6 Compare May 26, 2026 12:01

solnic changed the base branch from master to fix/broaden-conn-scrubber May 26, 2026 12:07

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from ad495d6 to e17e51e Compare May 28, 2026 11:33

solnic changed the base branch from fix/broaden-conn-scrubber to refa/consolidate-plug-scrubber-access May 28, 2026 11:34

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from e17e51e to c0c9dc8 Compare May 29, 2026 12:46

solnic force-pushed the refa/consolidate-plug-scrubber-access branch from 6d67fda to d234d46 Compare May 29, 2026 12:48

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from c0c9dc8 to 9f2ec07 Compare May 29, 2026 12:49

solnic mentioned this pull request May 29, 2026

refa(plug): consolidate access to the plug scrubber #1069

Merged

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch 2 times, most recently from 5a2edb0 to 6778f84 Compare June 1, 2026 09:38

solnic force-pushed the refa/consolidate-plug-scrubber-access branch 2 times, most recently from 4b4dd34 to e05c35a Compare June 3, 2026 12:35

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch 3 times, most recently from 03dd2d1 to 9240a03 Compare June 3, 2026 13:38

solnic commented Jun 3, 2026

View reviewed changes

solnic force-pushed the refa/consolidate-plug-scrubber-access branch from e05c35a to 6453968 Compare June 4, 2026 10:26

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from 9240a03 to 587cfb4 Compare June 4, 2026 10:26

solnic marked this pull request as ready for review June 4, 2026 12:43

cursor Bot reviewed Jun 4, 2026

View reviewed changes

Comment thread lib/sentry/event.ex Outdated

sentry Bot reviewed Jun 4, 2026

View reviewed changes

Comment thread lib/sentry/plug_capture.ex

solnic force-pushed the refa/consolidate-plug-scrubber-access branch from 6453968 to 211cdf8 Compare June 5, 2026 08:34

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch 2 times, most recently from 32d8cf6 to 5c7697d Compare June 5, 2026 12:04

whatyouhide approved these changes Jun 6, 2026

View reviewed changes

solnic force-pushed the refa/consolidate-plug-scrubber-access branch from ffeec1c to d7f79c1 Compare June 8, 2026 08:47

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from 5c7697d to 4ee788a Compare June 8, 2026 08:49

sentry Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread lib/sentry/plug_capture.ex

whatyouhide approved these changes Jun 8, 2026

View reviewed changes

Base automatically changed from refa/consolidate-plug-scrubber-access to master June 8, 2026 10:30

solnic and others added 4 commits June 8, 2026 10:41

test(plug): ensure custom scrubber is used for stacktraces

d3f901d

refa(plug): introduce stacktrace scrubber

49552a1

This unifies dealing with exceptions and scrubbing. Previously it would special-case function clause errors from phoenix which was not sufficient. Now we scrub plug conn consistently when reporting exceptions.

solnic force-pushed the fix/scrub-sensitive-data-from-stacktraces branch from 4ee788a to 73a3f74 Compare June 8, 2026 12:20

sentry Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread lib/sentry/scrubber/stacktrace_scrubber.ex

solnic added 2 commits June 8, 2026 12:49

test(plug): fix tests

f3df1ab

changes in master surfaced this but it will be restored in the follow-up scrubb-broadening branch

fix(scrubber): handle atom struct keys too

f4edab8

solnic merged commit b4e55c2 into master Jun 8, 2026
15 checks passed

solnic deleted the fix/scrub-sensitive-data-from-stacktraces branch June 8, 2026 13:26

github-actions Bot mentioned this pull request Jun 8, 2026

[skill-drift] fix(sentry-elixir-sdk): add v13.1-13.2 config options getsentry/sentry-for-ai#160

Merged

github-actions Bot mentioned this pull request Jun 15, 2026

[skill-drift] update(sentry-elixir-sdk): bump version to v13.2.0 getsentry/sentry-for-ai#170

Merged

timkonieczny mentioned this pull request Sep 7, 2026

Conn structs in stacktrace frame vars leak credentials via query_string, request_path and path_info #1195

Closed

Navigation Menu

Repository navigation

feat(scrubbing): implement PII scrubbing for stacktrace args - #1068

feat(scrubbing): implement PII scrubbing for stacktrace args#1068
solnic merged 6 commits into
masterfrom
fix/scrub-sensitive-data-from-stacktraces

solnic commented May 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

solnic Jun 3, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

solnic commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

New reusable exception stacktrace scrubber

Uh oh!

Uh oh!

solnic Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

solnic commented May 25, 2026 •

edited

Loading