Error Tracking Security Testing

Sentry Security Testing: Default Credentials, API Key, Database, and Error Tracking

📅 July 3, 2026 ⏱ 10 min read 🏷 Sentry, Error Tracking Security, SENTRY_SECRET_KEY, Django Session Forgery, DSN Token, PostgreSQL, Error Events PII, Admin Credentials, API Token

Sentry is a widely deployed self-hosted error tracking platform — organizations use it to capture application errors, performance issues, and crashes across their entire stack. Key assessment areas: SENTRY_SECRET_KEY enables Django session cookie forgery for any user; error events stored in PostgreSQL contain stack traces with hardcoded credentials, PII, and internal endpoint URLs; DSN tokens extracted from client applications allow submitting events; and PostgreSQL provides all user accounts and authentication tokens. This guide covers systematic Sentry security assessment.

SENTRY_SECRET_KEY Extraction and Session Forgery
Error Event Data: Credentials, PII, and Architecture
PostgreSQL Database and Configuration Assessment
Sentry Security Hardening

SENTRY_SECRET_KEY Extraction and Session Forgery

# Sentry self-hosted — SENTRY_SECRET_KEY extraction and session forgery
SENTRY_URL="https://sentry.example.com"

# sentry.conf.py — Sentry configuration
cat /etc/sentry/sentry.conf.py 2>/dev/null | head -30
# SECRET_KEY = '...'     <-- Django secret key for session signing
# DATABASES = {...}      <-- PostgreSQL connection details
# REDIS_URL = '...'      <-- Redis connection

# .env / environment variables
docker inspect sentry-web 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['SECRET_KEY','SENTRY_DB','SENTRY_POSTGRES',
                                  'SENTRY_REDIS','SENTRY_EMAIL','SENTRY_SECRET']):
            print(e)
" 2>/dev/null
# SENTRY_SECRET_KEY=...
# SENTRY_DB_PASSWORD=...
# SENTRY_POSTGRES_HOST=...

# Test default admin credentials
for CRED in "admin@sentry.local:admin" "admin@example.com:sentry" "root@sentry.local:root"; do
  EMAIL=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${SENTRY_URL}/auth/login/" \
    -d "username=${EMAIL}&password=${PASS}" 2>/dev/null)
  echo "${EMAIL}/${PASS}: HTTP ${STATUS}"
done

# API token — enumerate organizations (may work with user token)
SENTRY_TOKEN="your-api-token"
curl -s "${SENTRY_URL}/api/0/organizations/" \
  -H "Authorization: Bearer ${SENTRY_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for o in (d if isinstance(d,list) else []):
    print(f'  {o.get(\"name\")} - {o.get(\"slug\")}')
" 2>/dev/null

Error Event Data: Credentials, PII, and Architecture

# Sentry error event data — credentials, PII, and architecture exposure
SENTRY_URL="https://sentry.example.com"
SENTRY_TOKEN="your-api-token"
ORG_SLUG="your-org"
PROJECT_SLUG="your-project"

# List all projects in organization
curl -s "${SENTRY_URL}/api/0/organizations/${ORG_SLUG}/projects/" \
  -H "Authorization: Bearer ${SENTRY_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for p in d:
    print(f'  [{p.get(\"id\")}] {p.get(\"name\")} - DSN: {p.get(\"options\",{}).get(\"sentry:token\",\"\")}')
" 2>/dev/null

# Get DSN for a project (allows event submission)
curl -s "${SENTRY_URL}/api/0/projects/${ORG_SLUG}/${PROJECT_SLUG}/keys/" \
  -H "Authorization: Bearer ${SENTRY_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for k in d:
    print(f'  DSN: {k.get(\"dsn\",{}).get(\"public\")}')
    print(f'  Store: {k.get(\"dsn\",{}).get(\"store\")}')
" 2>/dev/null

# List recent error events (contain stack traces, environment variables, user data)
curl -s "${SENTRY_URL}/api/0/projects/${ORG_SLUG}/${PROJECT_SLUG}/events/?limit=5" \
  -H "Authorization: Bearer ${SENTRY_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for e in d:
    print(f'Event: {e.get(\"eventID\")}')
    print(f'  Message: {str(e.get(\"message\",\"\"))[:80]}')
    # Check extra context for leaked credentials
    extra = e.get('extra',{})
    for k,v in extra.items():
        if any(s in k.lower() for s in ['pass','key','secret','token','auth']):
            print(f'  SENSITIVE extra.{k}: {str(v)[:60]}')
    # Check request data
    req = e.get('request',{})
    for h,v in req.get('headers',{}).items():
        if 'authorization' in h.lower():
            print(f'  Auth header: {v[:60]}')
" 2>/dev/null

# PostgreSQL — error events with sensitive data
psql "postgresql://sentry:PASSWORD@localhost:5432/sentry" 2>/dev/null << 'EOF'
-- Recent error events with their data
SELECT e.event_id, e.datetime, e.data
FROM sentry_eventtag et
JOIN sentry_groupedmessage g ON et.group_id = g.id
LIMIT 5;

-- User accounts and their API tokens
SELECT sa.email, sa.is_superuser, sa.is_active,
       sat.token, sat.scope_list
FROM sentry_authidentity sa
LEFT JOIN sentry_apitoken sat ON sat.user_id = sa.id
LIMIT 20;
EOF

PostgreSQL Database and Configuration Assessment

# Sentry PostgreSQL database and configuration assessment

# Extract database URL from sentry.conf.py
python3 -c "
import re
content = open('/etc/sentry/sentry.conf.py').read()
# DATABASES config
db_match = re.search(r\"DATABASES\s*=\s*\{.*?'PASSWORD':\s*'([^']+)'\", content, re.DOTALL)
if db_match:
    print(f'DB Password: {db_match.group(1)[:60]}')
secret_match = re.search(r\"SECRET_KEY\s*=\s*'([^']+)'\", content)
if secret_match:
    print(f'SECRET_KEY: {secret_match.group(1)[:60]}')
" 2>/dev/null

# PostgreSQL — Sentry schema overview
psql "postgresql://sentry:PASSWORD@localhost:5432/sentry" 2>/dev/null << 'EOF'
-- All user accounts
SELECT id, email, name, is_superuser, is_active, date_joined
FROM sentry_auth_user
ORDER BY is_superuser DESC, date_joined
LIMIT 20;

-- API tokens (used for programmatic access)
SELECT user_id, token, scope_list, date_added, expires_at
FROM sentry_apitoken
WHERE expires_at IS NULL OR expires_at > NOW()
ORDER BY date_added DESC
LIMIT 20;

-- Project DSN keys (used by client applications to send events)
SELECT pk.project_id, pk.public_key, pk.secret_key,
       p.name as project_name
FROM sentry_projectkey pk
JOIN sentry_project p ON pk.project_id = p.id
LIMIT 20;
EOF

# Source maps — uploaded JavaScript source maps
# Sentry stores source maps for error de-obfuscation
# These contain the original JavaScript source code
curl -s "${SENTRY_URL}/api/0/projects/${ORG_SLUG}/${PROJECT_SLUG}/files/?file_type=source_map&limit=5" \
  -H "Authorization: Bearer ${SENTRY_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for f in d:
    print(f'  {f.get(\"name\")} - {f.get(\"size\")} bytes')
    # Source maps reveal original unminified source code
" 2>/dev/null

Sentry Security Hardening

Sentry Security Hardening Checklist:

Protect SENTRY_SECRET_KEY and rotate if exposed — Sentry's SECRET_KEY is a Django application key used to sign session cookies and CSRF tokens; if this key is extracted, an attacker can forge session cookies to authenticate as any user including administrators, generate valid CSRF tokens to bypass protection, and sign any data that Django stores server-side; the key is set in sentry.conf.py or as an environment variable SENTRY_SECRET_KEY; protect sentry.conf.py with chmod 640 restricted to the sentry service user; rotate the SECRET_KEY by generating a new 50-character random string and restarting Sentry — all existing sessions are immediately invalidated; in a Docker deployment, store the key in a secrets manager rather than in docker-compose.yml or environment files
Understand that error events are a goldmine of sensitive data — Sentry captures application error context that frequently contains sensitive information; common findings in error events include: environment variables attached to the error context (NODE_ENV, DATABASE_URL, API keys), request headers including Authorization and Cookie values, HTTP request bodies that may contain passwords or payment data, variable values from the call stack at the time of the error (connection strings, tokens, PII), and custom extra context that developers add for debugging; assess what context your applications are sending to Sentry; use Sentry's data scrubbing and PII filtering features to remove sensitive values before they are stored; configure sensitive field names to be automatically redacted
Restrict access to the Sentry instance and audit API tokens — self-hosted Sentry should be accessible only to authorized team members; placing Sentry behind a VPN or network access control significantly reduces the attack surface; audit all API tokens in the sentry_apitoken table — tokens without expiry dates are persistent credentials that remain valid indefinitely; implement token expiry policies and rotate long-lived tokens; be aware that members of a Sentry organization can access all error events in projects they are members of, including any sensitive data in those events; review organization member lists and apply least-privilege project membership
Secure the PostgreSQL database and Redis instances — Sentry's PostgreSQL database contains all user accounts, API tokens, project DSN keys, and stored error events; MongoDB unauthenticated access allows extracting every API token and DSN key in the system; configure PostgreSQL with authentication and restrict access to the Sentry application host only; Redis is used for session storage and task queuing — if Redis is accessible without authentication, active session data can be read or overwritten; set a Redis password (requirepass) and bind Redis to localhost; PostgreSQL credentials in sentry.conf.py should be a dedicated sentry user with permissions only to the sentry database
Audit DSN token exposure in client applications — Sentry DSN tokens (format: https://key@sentry.example.com/project-id) are embedded in client applications to enable event submission; DSN tokens in JavaScript bundles are publicly accessible via the browser; in mobile applications, they can be extracted by reverse engineering the APK/IPA; extracted DSN tokens can be used to submit arbitrary error events to your Sentry project, potentially filling storage or injecting misleading error data; rotate DSN keys for compromised projects via the project settings; consider using Sentry's security header to restrict event submissions to trusted origins; monitor for anomalous event submission volumes

Security Test	Method	Risk
SENTRY_SECRET_KEY extraction and Django session cookie forgery	Read sentry.conf.py or Docker env SENTRY_SECRET_KEY — forge session cookies for any user; admin account takeover without knowing credentials	Critical
Error event sensitive data extraction	GET /api/0/projects/{org}/{project}/events/ — stack traces with hardcoded credentials, environment variables, Authorization headers, PII from request context	High
PostgreSQL sentry_apitoken extraction	SELECT token FROM sentry_apitoken — all API tokens including permanent non-expiring tokens; full programmatic Sentry access	High
Project DSN key extraction — event submission	GET /api/0/projects/{org}/{project}/keys/ — DSN tokens allowing arbitrary event submission; storage exhaustion or misleading alert injection	Medium
Source map extraction — original JavaScript source	GET /api/0/projects/{org}/{project}/files/ — original unminified JavaScript source uploaded for error de-obfuscation; business logic and secret exposure	High

Automate Sentry Security Testing

Ironimo tests Sentry deployments for SENTRY_SECRET_KEY extraction and Django session cookie forgery, admin credential testing via /auth/login/, PostgreSQL sentry_apitoken and user account extraction, error event sensitive data analysis for credentials and PII, project DSN key enumeration, source map JavaScript source exposure, Docker environment variable secret disclosure, Redis unauthenticated session access, /api/0/organizations/ enumeration without authentication, and sentry.conf.py database credential extraction.

Start free scan

Table of Contents

SENTRY_SECRET_KEY Extraction and Session Forgery

Error Event Data: Credentials, PII, and Architecture

PostgreSQL Database and Configuration Assessment

Sentry Security Hardening

Automate Sentry Security Testing