Repository navigation
feat(service): Redact the secrets that a run sends - #11
Merged
Merged
Conversation
A run can now send secrets in its config. The service redacts them with the secrets of the service config and keeps them only in memory. Clients use this for the credentials of a CI job that a response can show but no request header has. Redaction also matches the JSON-escaped form of each value, because the recorder redacts the JSON text of a recording. Co-Authored-By: David Cramer <david@sentry.io>
sentry-junior Bot
added a commit
to getsentry/junior
that referenced
this pull request
Oct 16, 2026
The local proxy redacted the values of AI_GATEWAY_API_KEY, SENTRY_EVALS_API_KEY, VERCEL_OIDC_TOKEN, and VERCEL_TOKEN in every recording. The service only knew credential headers, so a response that showed one of these values was written to the public bucket. The run config now sends them as secrets (getsentry/roach#11). A service without that change ignores the field. Co-Authored-By: David Cramer <david@sentry.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A run can now send
secretsin itsRunConfig. The service redacts them in each recording, together with thesecretsof the service config and the credentials that it learns from request headers.Before this change, only the service config could add secrets. A client could not add the credentials of its own CI job, so a value that a response shows but no request header has was written to the bucket. Recordings are public to read. Junior's local proxy used to redact
AI_GATEWAY_API_KEY,SENTRY_EVALS_API_KEY,VERCEL_OIDC_TOKEN, andVERCEL_TOKENthis way. getsentry/junior#2156 lost that when it moved to the service."or\did not match before.This needs no Terraform change. It takes effect when the VM runs the new image.
pnpm checkpasses (on Node 22 in the sandbox).via David Cramer.
--
View Junior Session [Sentry]