Skip to content

Commit 4a24fbe

Browse files
authored
fix(pii): Add private keys as secret key name (#1376)
https://twitter.com/MoonRankNFT/status/1554911833617641472/photo/1 Its been reported that someone was - likely accidentally - sending a private key to their Sentry instance. There's not a great use case to allow storing that kind of value, so we are adding it to our default blocklists. The hashes and "mnemonic" seem not very useful for pattern matching, but we can at least filter out the string if it contains the word "privatekey" (case-insensitive)
1 parent 3832874 commit 4a24fbe

File tree

2 files changed

+2
-1
lines changed

2 files changed

+2
-1
lines changed

CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
**Features**:
66

77
- Parse sample rates as JSON. ([#1353](https://github.com/getsentry/relay/pull/1353))
8+
- Add `privatekey` and `private_key` as secret key name to datascrubbers. ([#1376](https://github.com/getsentry/relay/pull/1376))
89

910
**Internal**:
1011

relay-general/src/pii/regexes.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,6 @@ lazy_static! {
229229
"#
230230
).unwrap();
231231
static ref PASSWORD_KEY_REGEX: Regex = Regex::new(
232-
r"(?i)(password|secret|passwd|api_key|apikey|access_token|auth|credentials|mysql_pwd|stripetoken)"
232+
r"(?i)(password|secret|passwd|api_key|apikey|access_token|auth|credentials|mysql_pwd|stripetoken|privatekey|private_key)"
233233
).unwrap();
234234
}

0 commit comments

Comments
 (0)