sentry/scrubSensitiveData.ts

Redacts sensitive keys from Sentry events before sending, protecting credentials.

// Source: https://github.com/glama-ai/lightport | License: MIT | Copyright 2026 Frank Fiegel (frank@glama.ai)
// Provided via justclaw.it.com; keep this notice with the code.
import type { ErrorEvent } from '@sentry/core';

const REDACTED = '[Redacted]';

// Guards against pathological nesting. The payload is already normalized and
// acyclic by the time beforeSend runs.
const MAX_DEPTH = 10;

/**
 * Derived from Sentry's own SENSITIVE_KEY_SNIPPETS, which it applies to headers,
 * cookies and query params but never to `contexts` or `extra`.
 *
 * `passphrase` and `serviceaccount` are added for credential fields particular
 * to this gateway (oracleKeyPassphrase, vertexServiceAccountJson). Sentry's
 * `csrf`, `xsrf`, `sid`, `identity` and `sso` are dropped: there is no cookie or
 * form su

... (truncated -- full source via MCP)