Sentry (browser)

Sentry's CDN hosts for the browser SDK, the `@sentry/browser` package name or a `Sentry.init(` call in the markup.

A DSN URL of the form `https://<key>@<host>sentry.io/<project>`, or a request target on `ingest.sentry.io`.

Any one match reports the browser integration. Keys in the evidence are masked.

The detection covers the browser only; server-side error tracking is not observable from outside.

Sentry's documentation explains that a DSN tells the SDK where to send events so they reach the right project.

It states that DSNs are safe to keep public because they only allow submission of new events and related data, and do not allow read access to any information.

It acknowledges the remaining risk — anyone can send events to the project — calls it rare, and points to IP blocking and to rotating or revoking the key in the project's client key settings.

A DSN in a page is therefore not a leaked secret, and an audit does not report it as one.

Session Replay records what visitors see and do, which makes its masking configuration the part worth reviewing.

Sentry's privacy documentation says the replay SDK by default masks all text content with asterisks and blocks media elements — images, SVG, video, audio and embeds — on the client before sending.

Masking all text can be turned off with `maskAllText`, and specific elements can be masked or blocked with dedicated classes.

The documentation advises verifying the masking configuration before enabling Replay in production.

It can tell that the browser SDK loads on the pages crawled, and on which pages.

It cannot tell whether Session Replay is enabled, what sampling rates are set, or how masking is configured.

It cannot see backend Sentry use, and an absence of browser signals never means no error tracking exists.

The SDK is a third-party script, and its weight and position in the page are measured like any other.

`monitoring.sentry` reports the browser integration when detected, and not verifiable otherwise.

`monitoring.summary` places it among the other public monitoring signals.

`devops.observability_public` reports public observability tooling as a whole.

`performance.third_party_resources` measures what third-party scripts, the SDK included, add to the page.

Sentry's SDK options include `tunnel`, which sets a URL of the site's own to which the SDK sends events instead of Sentry's ingestion host.

The documentation presents it as a way to work around ad blockers or to get finer control over what is sent, and says it requires implementing a custom server endpoint.

The DSN is still required when tunnelling, so it still appears in the page.

A site that tunnels its events shows the SDK in its scripts without requests to Sentry's hosts, which is why the detection reads the SDK itself and not only the network target.