Your Sentry Breadcrumbs Are Carrying Someone Else's PHI

The Bug You Didn't Write

Your Go service handles concurrent HTTP requests. You're using
sentryzerolog to ship breadcrumbs and errors to Sentry for
observability. Everything looks clean in code review. Then someone
runs a HIPAA audit and finds patient names, DOB strings, and
medication codes inside Sentry error payloads for requests that
never touched those patients.

You didn't write this bug. The architecture did.

Why This Happens

The sentry-zerolog integration stores a single Hub inside the
Writer struct, initialized once at construction time:

go
type Writer struct {
    hub    *sentry.Hub  // fixed at creation — shared across ALL goroutines
    levels []zerolog.Level