@spec default_header_keys() :: [String.t()]

Returns the default list of sensitive header keys.

@spec default_param_keys() :: [String.t()]

Returns the SDK default list of sensitive parameter keys.

A key is sensitive when any of these terms appears anywhere in its name, compared case-insensitively. The scrubber: [param_keys: ...] configuration option extends this list; it cannot shorten it.

@spec default_private_allow_list() :: [atom()]

Returns the default list of %Plug.Conn{} :private keys retained by the :private_allow_list scrubbing strategy.

These are Phoenix's routing/render metadata keys, kept because they are high-signal, non-sensitive breadcrumbs for triaging errors. This is the default for the scrubber: [conn_private_allow_list: ...] configuration option.

@spec drop_keys(map(), [option()]) :: map()

Drops sensitive keys from a flat map.

This is the strategy used for HTTP headers, where the sensitive value should not appear in the payload at all.

Options

• :keys - the list of sensitive keys to drop. Defaults to default_header_keys/0.

@spec get(atom()) :: (Plug.Conn.t() -> term())

Returns the current process's resolved scrubber function for the given field.

key is one of [:body_scrubber, :header_scrubber, :cookie_scrubber, :url_scrubber]. Returns the scrubber registered via put_conn_scrubber/1, or the field's default if none was registered. The returned function takes a %Plug.Conn{} and returns the scrubbed value, so callers apply it as Sentry.Scrubber.get(:url_scrubber).(conn).

@spec new(conn_scrubber_opts()) :: t()

Builds a resolved t/0 set of per-field scrubbers from the given options.

Accepts the same :body_scrubber, :header_scrubber, :cookie_scrubber, and :url_scrubber keys as put_conn_scrubber/1. Each missing key falls back to the field's default scrubber (the matching scrub(conn, field) clause). Called with no arguments, new/0 returns the all-defaults scrubber.

Unlike put_conn_scrubber/1, this only constructs the struct — it does not register it for the current process.

@spec put_conn_scrubber(conn_scrubber_opts()) :: :ok

Registers the current process's per-field scrubbers for %Plug.Conn{}.

Accepts the same :body_scrubber, :header_scrubber, :cookie_scrubber, and :url_scrubber keys that Sentry.PlugContext takes as plug options, resolves each missing key to the field's default scrubber (the {__MODULE__, :scrub, [field]} MFA, i.e. the matching scrub(conn, field) clause), and stores the resolved scrubbers in the process dictionary.

The registration lives for the lifetime of the calling process — typically the request process when registered from Sentry.PlugContext.call/2. Used by other parts of the SDK (notably Sentry.PlugCapture) so all conn scrubbing honors the same configuration the user passed to plug Sentry.PlugContext.

Returns :ok.

@spec scrub(Plug.Conn.t()) :: Plug.Conn.t()

@spec scrub(map()) :: map()

@spec scrub(term()) :: term()

Scrubs a %Plug.Conn{} or a plain map.

Given a %Plug.Conn{}, scrubs each field listed in @scrubbable_conn_fields according to its strategy — see the "Scrubbing a %Plug.Conn{}" section in the module docs and scrub/2 for the per-field defaults and how to override them per call. This includes request_path, path_info and query_string, which are derived from the URL the registered :url_scrubber returns. The reported request URL is not a conn field; callers scrub that separately by applying the :url_scrubber from get/1 (whose default is scrub(conn, :url)).

Given a plain map, recursively scrubs it with the default sensitive keys — equivalent to scrub(map, []). Any other struct is converted to a map and scrubbed the same way, so a sensitive field can't slip through unredacted — for example when the struct is inspected into stacktrace frame vars. See scrub/2.

@spec scrub(map(), [option()]) :: map()

@spec scrub(list(), [option()]) :: list()

@spec scrub(term(), [option()]) :: term()

@spec scrub(
  Plug.Conn.t(),
  keyword()
) :: Plug.Conn.t()

@spec scrub(Plug.Conn.t(), :body | :headers | :cookies | :url) :: term()

Scrubs a value with the given options, dispatching on the value's type.

Scrubbing a map, list, or leaf value — scrub(value, opts)

Recursively scrubs a map: any value whose key is in the configured sensitive key list is replaced with the placeholder, and the remaining values are scrubbed in turn. Lists are scrubbed element-wise, structs are scrubbed as maps, and credit-card-shaped binaries are replaced with the placeholder. Any other leaf value is returned unchanged.

Accepts the same :keys option as the other scrubbing functions:

• :keys - the list of sensitive keys to redact. Defaults to default_param_keys/0.

Scrubbing a single %Plug.Conn{} field — scrub(conn, field)

Extracts the given field from the conn and applies the SDK's default redaction for it. Each clause is what the field's default scrubber captures as a {__MODULE__, :scrub, [field]} MFA, and what scrub/1 (conn fields) and get/1 (URL) fall back to when no custom scrubber is registered:

• :body — scrubs conn.params via scrub/2; non-map params (such as %Plug.Conn.Unfetched{}) pass through unchanged.
• :headers — drops sensitive conn.req_headers case-insensitively, preserving the list-of-tuples shape.
• :cookies — drops all cookies, returning %{}.
• :url — scrubs sensitive query parameters from the request URL via scrub_url/1. To disable URL scrubbing, register a :url_scrubber of nil (or a custom one); see Sentry.PlugContext.

Because these clauses are the defaults (not the registered scrubbers), a custom :body_scrubber can safely compose on the default behavior without recursing:

defmodule MyScrubber do
  def scrub_params(conn) do
    conn
    |> Sentry.Scrubber.scrub(:body)
    |> Map.drop(["my_secret_field"])
  end
end

Scrubbing a whole %Plug.Conn{} with overrides — scrub(conn, overrides)

Behaves like scrub/1 but merges the field: strategy keyword overrides over the @scrubbable_conn_fields defaults, so a caller can scrub additional fields or change a field's strategy for that call. Strategies are a configurable scrubber struct-key, :clear (replace with %{}), :params (params-shaped scrub of that field), :query_string (redact sensitive params from that raw query string), :url_scrubbed (derive that field from the scrubbed URL), or :private_allow_list (keep only the allow-listed keys):

Sentry.Scrubber.scrub(conn, assigns: :clear, query_params: :params)

@spec scrub_query_string(String.t(), [option()]) :: String.t()

Scrubs an application/x-www-form-urlencoded query string, replacing the value of any sensitive parameter with the placeholder.

Options

See scrub/2.

@spec scrub_url(String.t(), [option()]) :: String.t()

Scrubs the query string portion of a URL, replacing the value of any sensitive query parameter with the placeholder. URLs without a query string are returned unchanged.

Options

See scrub/2.

@spec scrubbed_value() :: String.t()

Returns the placeholder that replaces redacted values: "[Filtered]".