Skip to content

fix(attributes): Increase some PII values #373

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
loewenheim merged 3 commits into from
May 13, 2026
Merged

fix(attributes): Increase some PII values #373

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8f927b6
fix(attributes): Increase some PII values
loewenheim May 13, 2026
fb34ac6
Also handle aliases
loewenheim May 13, 2026
6c0a80c
yarn generate
loewenheim May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 16 additions & 16 deletions javascript/sentry-conventions/src/attributes.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -495,7 +495,7 @@ export type AI_SEED_TYPE = string;
*
* Attribute Value Type: `boolean` {@link AI_STREAMING_TYPE}
*
* Contains PII: false
* Contains PII: maybe
*
* Attribute defined in OTEL: No
*
Expand Down Expand Up @@ -4631,7 +4631,7 @@ export type GEN_AI_RESPONSE_MODEL_TYPE = string;
*
* Attribute Value Type: `boolean` {@link GEN_AI_RESPONSE_STREAMING_TYPE}
*
* Contains PII: false
* Contains PII: maybe
*
* Attribute defined in OTEL: No
*
Expand Down Expand Up @@ -5364,7 +5364,7 @@ export type HTTP_METHOD_TYPE = string;
*
* Attribute Value Type: `string` {@link HTTP_QUERY_TYPE}
*
* Contains PII: maybe - Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.
* Contains PII: true - Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.
*
* Attribute defined in OTEL: No
*
Expand Down Expand Up @@ -6039,7 +6039,7 @@ export type HTTP_TARGET_TYPE = string;
*
* Attribute Value Type: `string` {@link HTTP_URL_TYPE}
*
* Contains PII: maybe
* Contains PII: true
*
* Attribute defined in OTEL: Yes
*
Expand Down Expand Up @@ -10293,7 +10293,7 @@ export type SERVICE_VERSION_TYPE = string;
*
* Attribute Value Type: `number` {@link THREAD_ID_TYPE}
*
* Contains PII: false
* Contains PII: maybe
*
* Attribute defined in OTEL: Yes
*
Expand Down Expand Up @@ -10728,7 +10728,7 @@ export type UI_ELEMENT_WIDTH_TYPE = number;
*
* Attribute Value Type: `string` {@link URL_TYPE}
*
* Contains PII: maybe
* Contains PII: true
*
* Attribute defined in OTEL: No
*
Expand Down Expand Up @@ -10791,7 +10791,7 @@ export type URL_FRAGMENT_TYPE = string;
*
* Attribute Value Type: `string` {@link URL_FULL_TYPE}
*
* Contains PII: maybe
* Contains PII: true
*
* Attribute defined in OTEL: Yes
*
Expand Down Expand Up @@ -10877,7 +10877,7 @@ export type URL_PORT_TYPE = number;
*
* Attribute Value Type: `string` {@link URL_QUERY_TYPE}
*
* Contains PII: maybe - Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.
* Contains PII: true - Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.
*
* Attribute defined in OTEL: Yes
*
Expand Down Expand Up @@ -13427,7 +13427,7 @@ export const ATTRIBUTE_METADATA: Record<AttributeName, AttributeMetadata> = {
brief: 'Whether the request was streamed back.',
type: 'boolean',
pii: {
isPii: 'false',
isPii: 'maybe',
},
isInOtel: false,
example: true,
Expand Down Expand Up @@ -15928,7 +15928,7 @@ export const ATTRIBUTE_METADATA: Record<AttributeName, AttributeMetadata> = {
brief: "Whether or not the AI model call's response was streamed back asynchronously",
type: 'boolean',
pii: {
isPii: 'false',
isPii: 'maybe',
Comment thread
cursor[bot] marked this conversation as resolved.
},
isInOtel: false,
example: true,
Expand Down Expand Up @@ -16400,7 +16400,7 @@ export const ATTRIBUTE_METADATA: Record<AttributeName, AttributeMetadata> = {
'The query string present in the URL. Note that this contains the leading ? character, while the `url.query` attribute does not.',
type: 'string',
pii: {
isPii: 'maybe',
isPii: 'true',
reason:
'Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.',
},
Expand Down Expand Up @@ -16801,7 +16801,7 @@ export const ATTRIBUTE_METADATA: Record<AttributeName, AttributeMetadata> = {
brief: 'The URL of the resource that was fetched.',
type: 'string',
pii: {
isPii: 'maybe',
isPii: 'true',
},
isInOtel: true,
example: 'https://example.com/test?foo=bar#buzz',
Expand Down Expand Up @@ -19197,7 +19197,7 @@ export const ATTRIBUTE_METADATA: Record<AttributeName, AttributeMetadata> = {
brief: 'Current “managed” thread ID.',
type: 'integer',
pii: {
isPii: 'false',
isPii: 'maybe',
},
isInOtel: true,
example: 56,
Expand Down Expand Up @@ -19461,7 +19461,7 @@ export const ATTRIBUTE_METADATA: Record<AttributeName, AttributeMetadata> = {
brief: 'The URL of the resource that was fetched.',
type: 'string',
pii: {
isPii: 'maybe',
isPii: 'true',
},
isInOtel: false,
example: 'https://example.com/test?foo=bar#buzz',
Expand Down Expand Up @@ -19498,7 +19498,7 @@ export const ATTRIBUTE_METADATA: Record<AttributeName, AttributeMetadata> = {
brief: 'The URL of the resource that was fetched.',
type: 'string',
pii: {
isPii: 'maybe',
isPii: 'true',
},
isInOtel: true,
example: 'https://example.com/test?foo=bar#buzz',
Expand Down Expand Up @@ -19543,7 +19543,7 @@ export const ATTRIBUTE_METADATA: Record<AttributeName, AttributeMetadata> = {
'The query string present in the URL. Note that this does not contain the leading ? character, while the `http.query` attribute does.',
type: 'string',
pii: {
isPii: 'maybe',
isPii: 'true',
reason:
'Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.',
},
Expand Down
2 changes: 1 addition & 1 deletion model/attributes/ai/ai__streaming.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"brief": "Whether the request was streamed back.",
"type": "boolean",
"pii": {
"key": "false"
"key": "maybe"
},
"is_in_otel": false,
"example": true,
Expand Down
2 changes: 1 addition & 1 deletion model/attributes/gen_ai/gen_ai__response__streaming.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"brief": "Whether or not the AI model call's response was streamed back asynchronously",
"type": "boolean",
"pii": {
"key": "false"
"key": "maybe"
},
"is_in_otel": false,
"example": true,
Expand Down
2 changes: 1 addition & 1 deletion model/attributes/http/http__query.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"brief": "The query string present in the URL. Note that this contains the leading ? character, while the `url.query` attribute does not.",
"type": "string",
"pii": {
"key": "maybe",
"key": "true",
"reason": "Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information."
},
"is_in_otel": false,
Expand Down
2 changes: 1 addition & 1 deletion model/attributes/http/http__url.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"brief": "The URL of the resource that was fetched.",
"type": "string",
"pii": {
"key": "maybe"
"key": "true"
},
"is_in_otel": true,
"example": "https://example.com/test?foo=bar#buzz",
Expand Down
2 changes: 1 addition & 1 deletion model/attributes/thread/thread__id.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"brief": "Current “managed” thread ID.",
"type": "integer",
"pii": {
"key": "false"
"key": "maybe"
},
"is_in_otel": true,
"example": 56,
Expand Down
2 changes: 1 addition & 1 deletion model/attributes/url.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"brief": "The URL of the resource that was fetched.",
"type": "string",
"pii": {
"key": "maybe"
"key": "true"
},
"is_in_otel": false,
"example": "https://example.com/test?foo=bar#buzz",
Expand Down
2 changes: 1 addition & 1 deletion model/attributes/url/url__full.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"brief": "The URL of the resource that was fetched.",
"type": "string",
"pii": {
"key": "maybe"
"key": "true"
},
"is_in_otel": true,
"example": "https://example.com/test?foo=bar#buzz",
Comment on lines 3 to 9
Copy link
Copy Markdown

@sentry sentry Bot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Updating the PII classification for a canonical attribute like url.full does not propagate the change to its deprecated alias, http.url.
Severity: MEDIUM

Suggested Fix

Modify the attribute update process to ensure that any changes to a canonical attribute's metadata, such as PII classification, are automatically propagated to all of its deprecated aliases. This will maintain data handling consistency.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: model/attributes/url/url__full.json#L3-L9

Potential issue: Updating the PII classification of a canonical attribute does not
propagate the change to its deprecated alias. For instance, the change classifies
`url.full` as PII `true`, but its alias `http.url` remains `maybe`. Similarly,
`gen_ai.response.streaming` is updated to `maybe`, while its alias `ai.streaming`
remains `false`. This inconsistency means the same data is treated differently for PII
depending on the attribute name used, which could lead to incorrect data handling.

Did we get this right? 👍 / 👎 to inform future reviews.

Expand Down
2 changes: 1 addition & 1 deletion model/attributes/url/url__query.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
"brief": "The query string present in the URL. Note that this does not contain the leading ? character, while the `http.query` attribute does.",
"type": "string",
"pii": {
"key": "maybe",
"key": "true",
"reason": "Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information."
},
"is_in_otel": true,
Expand Down
32 changes: 16 additions & 16 deletions python/src/sentry_conventions/attributes.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -518,7 +518,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"""Whether the request was streamed back.

Type: bool
Contains PII: false
Contains PII: maybe
Defined in OTEL: No
Aliases: gen_ai.response.streaming
DEPRECATED: Use gen_ai.response.streaming instead
Expand Down Expand Up @@ -2716,7 +2716,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"""Whether or not the AI model call's response was streamed back asynchronously

Type: bool
Contains PII: false
Contains PII: maybe
Defined in OTEL: No
Aliases: ai.streaming
Example: true
Expand Down Expand Up @@ -3124,7 +3124,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"""The query string present in the URL. Note that this contains the leading ? character, while the `url.query` attribute does not.

Type: str
Contains PII: maybe - Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.
Contains PII: true - Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.
Defined in OTEL: No
Example: "?foo=bar&bar=baz"
"""
Expand Down Expand Up @@ -3509,7 +3509,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"""The URL of the resource that was fetched.

Type: str
Contains PII: maybe
Contains PII: true
Defined in OTEL: Yes
Aliases: url.full, url
DEPRECATED: Use url.full instead
Expand Down Expand Up @@ -5761,7 +5761,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"""Current “managed” thread ID.

Type: int
Contains PII: false
Contains PII: maybe
Defined in OTEL: Yes
Example: 56
"""
Expand Down Expand Up @@ -6003,7 +6003,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"""The URL of the resource that was fetched.

Type: str
Contains PII: maybe
Contains PII: true
Defined in OTEL: Yes
Aliases: http.url, url
Example: "https://example.com/test?foo=bar#buzz"
Expand Down Expand Up @@ -6048,7 +6048,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"""The query string present in the URL. Note that this does not contain the leading ? character, while the `http.query` attribute does.

Type: str
Contains PII: maybe - Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.
Contains PII: true - Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.
Defined in OTEL: Yes
Example: "foo=bar&bar=baz"
"""
Expand Down Expand Up @@ -6080,7 +6080,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"""The URL of the resource that was fetched.

Type: str
Contains PII: maybe
Contains PII: true
Defined in OTEL: No
Aliases: url.full, http.url
DEPRECATED: Use url.full instead
Expand Down Expand Up @@ -6901,7 +6901,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"ai.streaming": AttributeMetadata(
brief="Whether the request was streamed back.",
type=AttributeType.BOOLEAN,
pii=PiiInfo(isPii=IsPii.FALSE),
pii=PiiInfo(isPii=IsPii.MAYBE),
is_in_otel=False,
example=True,
deprecation=DeprecationInfo(
Expand Down Expand Up @@ -9685,7 +9685,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"gen_ai.response.streaming": AttributeMetadata(
brief="Whether or not the AI model call's response was streamed back asynchronously",
type=AttributeType.BOOLEAN,
pii=PiiInfo(isPii=IsPii.FALSE),
pii=PiiInfo(isPii=IsPii.MAYBE),
is_in_otel=False,
example=True,
aliases=["ai.streaming"],
Expand Down Expand Up @@ -10131,7 +10131,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
brief="The query string present in the URL. Note that this contains the leading ? character, while the `url.query` attribute does not.",
type=AttributeType.STRING,
pii=PiiInfo(
isPii=IsPii.MAYBE,
isPii=IsPii.TRUE,
reason="Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.",
),
is_in_otel=False,
Expand Down Expand Up @@ -10547,7 +10547,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"http.url": AttributeMetadata(
brief="The URL of the resource that was fetched.",
type=AttributeType.STRING,
pii=PiiInfo(isPii=IsPii.MAYBE),
pii=PiiInfo(isPii=IsPii.TRUE),
is_in_otel=True,
example="https://example.com/test?foo=bar#buzz",
deprecation=DeprecationInfo(replacement="url.full"),
Expand Down Expand Up @@ -13012,7 +13012,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"thread.id": AttributeMetadata(
brief="Current “managed” thread ID.",
type=AttributeType.INTEGER,
pii=PiiInfo(isPii=IsPii.FALSE),
pii=PiiInfo(isPii=IsPii.MAYBE),
is_in_otel=True,
example=56,
changelog=[
Expand Down Expand Up @@ -13344,7 +13344,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"url.full": AttributeMetadata(
brief="The URL of the resource that was fetched.",
type=AttributeType.STRING,
pii=PiiInfo(isPii=IsPii.MAYBE),
pii=PiiInfo(isPii=IsPii.TRUE),
is_in_otel=True,
example="https://example.com/test?foo=bar#buzz",
aliases=["http.url", "url"],
Expand Down Expand Up @@ -13390,7 +13390,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
brief="The query string present in the URL. Note that this does not contain the leading ? character, while the `http.query` attribute does.",
type=AttributeType.STRING,
pii=PiiInfo(
isPii=IsPii.MAYBE,
isPii=IsPii.TRUE,
reason="Query string values can contain sensitive information. Clients should attempt to scrub parameters that might contain sensitive information.",
),
is_in_otel=True,
Expand Down Expand Up @@ -13426,7 +13426,7 @@ class ATTRIBUTE_NAMES(metaclass=_AttributeNamesMeta):
"url": AttributeMetadata(
brief="The URL of the resource that was fetched.",
type=AttributeType.STRING,
pii=PiiInfo(isPii=IsPii.MAYBE),
pii=PiiInfo(isPii=IsPii.TRUE),
is_in_otel=False,
example="https://example.com/test?foo=bar#buzz",
deprecation=DeprecationInfo(replacement="url.full"),
Expand Down
6 changes: 3 additions & 3 deletions shared/deprecated_attributes.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -545,7 +545,7 @@
"brief": "The URL of the resource that was fetched.",
"type": "string",
"pii": {
"key": "maybe"
"key": "true"
},
"is_in_otel": false,
"example": "https://example.com/test?foo=bar#buzz",
Expand Down Expand Up @@ -1091,7 +1091,7 @@
"brief": "Whether the request was streamed back.",
"type": "boolean",
"pii": {
"key": "false"
"key": "maybe"
},
"is_in_otel": false,
"example": true,
Expand Down Expand Up @@ -2454,7 +2454,7 @@
"brief": "The URL of the resource that was fetched.",
"type": "string",
"pii": {
"key": "maybe"
"key": "true"
},
"is_in_otel": true,
"example": "https://example.com/test?foo=bar#buzz",
Expand Down
Loading