Sentry Auth Token not detected

[cr7pt0gr4ph7]

Please review the Community Note before submitting

TruffleHog Version

trufflehog 3.83.5

Expected Behavior

Sentry Auth Tokens of the form sntrys_<long base64 encoded string> or sntryu_<long hex string> are detected by trufflehog.

Actual Behavior

The secret tokens are not detected.

Steps to Reproduce

1. Generate new Sentry Auth Token (as described in the Sentry docs)
2. Paste it into a file scanned by trufflehog
3. Run trufflehog

Environment

• OS: Linux

Additional Context

It seems that Sentry has changed the format of the auth tokens since this detector was implemented.

[kashifkhan0771]

This is correct. Sentry has updated the format of the user auth tokens.

[kashifkhan0771]

A new version of the Sentry detector has been added to support the newer Sentry user token patterns.

Regarding organization tokens, which start with sntrys, the documentation states:

"Organization Auth Tokens can be used in many places to interact with Sentry programmatically. For example, they can be used for sentry-cli, bundler plugins, or similar use cases."

If needed, a separate issue can be created to add a new detector specifically for Sentry organization tokens. However, it’s unclear which APIs utilize this token, as the documentation mentions its primary use is for the CLI.

For most APIs, the user authentication token is used. Additionally, some API endpoints may allow DSN-based authentication, though this is generally limited. An endpoint will specify if DSN-based authentication is supported. This works similarly to Bearer token authentication but uses the DSN (Client Key) instead.

[khanh-snapchat]

@kashifkhan0771 can we add sntrys as well? We have seen this leak and came to this issue, but apparently it was omitted from the change.

[ahrav]

@kashifkhan0771 can we add sntrys as well? We have seen this leak and came to this issue, but apparently it was omitted from the change.

From what I gathered in the Sentry docs, tokens that start with sntrys_ are Organization Auth Tokens, as @kashifkhan0771 mentioned earlier.

This means simply adding sntrys as a keyword or prefix in the regex wouldn’t be enough—the token’s length is also different. Additionally, the endpoint we currently use to verify Sentry tokens (https://sentry.io/api/0/organizations) can’t be used for Organization Auth Tokens.

From my (limited) reading, it looks like these tokens are mainly used in CI/CD or with Sentry’s CLI. To verify them correctly, we’d likely need additional context, such as the organization slug or DSN-based auth, as Kashif pointed out.

Given these constraints, it’s best to create a separate detector specifically for Organization Auth Tokens.

Let me know if I’ve misunderstood anything—this is just what I’ve gathered from reading the docs and testing with some credentials in the existing detector.

[khanh-snapchat]

thanks, @ahrav. Sorry i wasn't clear. Yes, i understood those differences with the current rule. I just wonder if your team has the bandwidth to also add that new detector as well? We have seen this committed in code and would like to be able to flag it.

[kashifkhan0771]

@ahrav is right.
Yes, we can create a separate detector, @khanh-snapchat, for these tokens with a different verification logic. Our team currently has some other higher priorities, but I'll add a story for this to our backlog.

[kashifkhan0771]

OSS-131 ticket is created in backlog to add a new detector for sntrys tokens.

[kashifkhan0771]

Fortunately, the new endpoint we updated in PR #3983 also supports org auth tokens 🥳. I'll work on adding a new detector for org auth tokens.

[kashifkhan0771]

Sentry Org Auth token detector is available now!