Leaked Sentry Access Token? Revoke It and Review Events

A Sentry auth token authenticates calls to the Sentry API and tools such as sentry-cli and build plugins. Depending on its scopes, it can read issues and events, upload source maps, create releases and change project settings. Error events often carry request data, user identifiers and stack traces with variable values, so a token with read access exposes more than it first seems. Revoke it first, then look at what it could read.

Check your GitHub account for leaked secrets — free

Provider: Sentry
Severity: High
Impact: SaaS account access and billing
Checked live by LeakWatch: No

What a Sentry access token looks like

The form this rule targets is a legacy auth token: 64 lowercase hexadecimal characters with no prefix:

…XXXX   Sentry auth token, legacy format (masked, 64 hex characters, no prefix)

Newer Sentry tokens carry readable prefixes that identify whether they are organization or user tokens, and LeakWatch covers them with separate rules. For the legacy form, nothing in the value says “Sentry”, so the label does the identification: SENTRY_AUTH_TOKEN, a .sentryclirc file, or a call to sentry.io/api. Do not confuse the token with a DSN, the project address that applications use to send events; a DSN is designed to be embedded in client code.

How Sentry access tokens get leaked

Build configuration. SENTRY_AUTH_TOKEN written in plain text in a CI workflow, a Dockerfile or a bundler plugin configuration.
.sentryclirc committed. The file written by sentry-cli login copied into a repository.
Environment files. A .env file with the token added so the build can upload source maps.
Front-end bundles. A token injected into client code by a misconfigured build variable.
Logs. A release step that prints its environment during a failed upload.

What to do in the first hour

Find the token. In Sentry, open your user settings and the auth tokens section, and check the organization settings for tokens created for integrations. Match the name, scopes and last use.
Create a replacement with only the scopes the build needs, usually release creation and source map upload.
Update your CI and check that a release still uploads.
Revoke the exposed token from the list where it appears. Requests using it are then rejected.
Review what it could read. If the scopes included event or project read access, consider that issues, user data and request details may have been seen. Check your audit log for changes to projects, members, alert rules, integrations and data scrubbing settings.
Check for tampering. Look for releases you did not create and source maps you did not upload, which could mislead debugging.
Look for neighbours. The same file may hold deploy or cloud keys. See I accidentally pushed an API key to GitHub.

Not sure what else leaked from the same repository? Run a free scan.

Not sure what else leaked? Run a free scan.

Revoke it at Sentry

Sentry auth tokens are managed from two places: personal tokens in your user settings, and organization or integration tokens in the organization settings. Sign in with an account that has access, find the exposed token and revoke it. Self-hosted installations have their own address, so open the settings of the instance named in the surrounding configuration. Sentry’s documentation describes token types and scopes. The interface can change, so if the labels differ from this guide, look for the section where auth tokens are created and listed.

How LeakWatch detects it

The rule is called Sentry Access Token. It is contextual: the word sentry must appear shortly before an assignment sign, followed by exactly 64 lowercase hex characters. A legacy token written without the word nearby will be missed, and any 64-character hash close to the word could be reported. The severity is high. This type is not checked live: LeakWatch does not test the value against Sentry, so a finding means a matching string was seen, not that it works. Check your token list to see whether it is still active.

LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.

FAQ

Is my Sentry DSN a secret I need to rotate?

Not in the same sense. A DSN lets someone send events to your project, which is why it appears in public JavaScript. It is worth rotating only if you see abusive event volume.

Can the token show my users' data?

If its scopes include reading events, it can read whatever your events contain. Check which scopes the token had and whether your data scrubbing settings removed sensitive fields.

The string I found is 64 hex characters but I am not sure it is Sentry's. What now?

Look at the code around it and compare the last characters with the tokens listed in your Sentry settings. A hash such as a commit digest has the same shape.