Skip to content

Merge branch 'master' into ivana/migrate-argv-2

a85cb01
Select commit
Loading
Failed to load commit list.
Merged

feat(argv): Support span streaming #6227

Merge branch 'master' into ivana/migrate-argv-2
a85cb01
Select commit
Loading
Failed to load commit list.
@sentry/warden / warden completed May 7, 2026 in 2m 29s

1 issue

Low

Experimental span streaming captures sys.argv without client-side scrubbing - `sentry_sdk/traces.py:574`

The experimental span streaming feature (_experiments={'trace_lifecycle': 'stream'}) sets process.command_args from sys.argv on all segment spans without client-side scrubbing (traces.py:574). Users who pass sensitive values as CLI arguments (e.g., --password=secret) and opt into this experimental feature may inadvertently send credentials to Sentry. This feature is explicitly marked EXPERIMENTAL and 'Do not use in production', limiting real-world exposure. The attributes bypass EventScrubber and are serialized directly via SpanBatcher._to_transport_format(). Server-side scrubbing may apply but is not verified in the client code.

4 skills analyzed
Skill Findings Duration Cost
code-review 1 40.5s $0.97
find-bugs 0 16.6s $0.07
skill-scanner 0 19.2s $0.09
security-review 0 17.5s $0.10

Duration: 1m 34s · Tokens: 293.0k in / 1.7k out · Cost: $1.23 (+verification: $0.79)