How Sentry SDK Handles Data Processing and Sensitive Information

Sensitive Data

Older SDKs sometimes provided complex constructs to let users strip sensitive data. Newer SDKs removed that capability because maintaining each SDK became difficult. Two configuration options remain:

send-default-pii is disabled by default, so natural sensitive data is not sent. When an HTTP request is attached to an event, the raw body that is not JSON or form‑data is removed, and known sensitive headers such as Authorization or Cookies are stripped. User‑specific information such as the current user ID from a web framework is never sent. If a request is explicitly set in a scope, the SDK does not remove anything from that request; the rules apply only to SDK‑provided integrations.

before-send can be used to register a callback with custom logic to delete sensitive data. Documentation: https://docs.sentry.io/error-reporting/configuration/#before-send

Variable Size Limits

The SDK enforces size limits on fields that users can specify in the event payload. Limits apply to metadata fields such as stack‑trace variables, context, tags, and extra data.

Mappings (e.g., HTTP data, extra data) are limited to 50 items.

Event ID is limited to 36 characters and must be a valid UUID.

Tag key is limited to 32 characters; tag value is limited to 200 characters.

Culprit is limited to 200 characters.

Context object is limited to 8kB.

Each extra data item is limited to 16kB; total extra data is limited to 256kB.

Message is limited to 8192 characters.

HTTP data (body) is limited to 8kB and is always trimmed before attachment.

Stack trace is limited to 50 frames; if more are sent, frames from the middle are removed.

These limits also apply to the total size of stored requests, event payloads, and attachments. Sentry rejects any request that exceeds these limits. Envelope endpoint size limits: https://develop.sentry.dev/sdk/envelopes/#size-limits. Store endpoint size limits: https://develop.sentry.dev/sdk/store/#size-limits.