feat(argv): Support span streaming #6227
+10
−0
Merged
@sentry/warden / warden
completed
May 7, 2026 in 2m 29s
1 issue
Low
Experimental span streaming captures sys.argv without client-side scrubbing - `sentry_sdk/traces.py:574`
The experimental span streaming feature (_experiments={'trace_lifecycle': 'stream'}) sets process.command_args from sys.argv on all segment spans without client-side scrubbing (traces.py:574). Users who pass sensitive values as CLI arguments (e.g., --password=secret) and opt into this experimental feature may inadvertently send credentials to Sentry. This feature is explicitly marked EXPERIMENTAL and 'Do not use in production', limiting real-world exposure. The attributes bypass EventScrubber and are serialized directly via SpanBatcher._to_transport_format(). Server-side scrubbing may apply but is not verified in the client code.
4 skills analyzed
| Skill | Findings | Duration | Cost |
|---|---|---|---|
| code-review | 1 | 40.5s | $0.97 |
| find-bugs | 0 | 16.6s | $0.07 |
| skill-scanner | 0 | 19.2s | $0.09 |
| security-review | 0 | 17.5s | $0.10 |
Duration: 1m 34s · Tokens: 293.0k in / 1.7k out · Cost: $1.23 (+verification: $0.79)
Loading