3 ms·
Maybe I misunderstood the article, but I thought it said that Django does strip this information, and the Sentry app went out of its way to store the secret key
by chatmasta 8y ago
Maybe I misunderstood the article, but I thought it said that Django does strip this information, and the Sentry app went out of its way to store the secret key in the SENTRY_OPTIONS payload. This custom, non-Django code effectively circumvents Django’s protections, making the bug the responsibility of Sentry, not Django.
- exikyut 8y agoAh. You're right, I completely got this bit wrong. Thanks. Wait, so that means Sentry kind of has a vulnerability.
- deleted 8y ago[deleted]
- the_mitsuhiko 8y agoSentry does secure `DEBUG` mode. It's for development only and must not be set by customers. That said, we will try to make it less easy to set by accident: https://github.com/getsentry/sentry/pull/9516 https://github.com/getsentry/sentry/pull/9516