The latest articles on DEV Community by Andrew Rogers (@arcompliance). https://dev.to/arcompliance https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4203534%2Ffe35934d-f5b3-4164-8f9d-57729ce76d4f.jpg https://dev.to/arcompliance en Andrew Rogers Sat, 24 Oct 2026 00:38:54 +0000 https://dev.to/arcompliance/your-sentry-breadcrumbs-are-carrying-someone-elses-phi-57nn https://dev.to/arcompliance/your-sentry-breadcrumbs-are-carrying-someone-elses-phi-57nn <h2> The Bug You Didn't Write </h2> <p>Your Go service handles concurrent HTTP requests. You're using<br> <code>sentryzerolog</code> to ship breadcrumbs and errors to Sentry for<br> observability. Everything looks clean in code review. Then someone<br> runs a HIPAA audit and finds patient names, DOB strings, and<br> medication codes inside Sentry error payloads for requests that<br> never touched those patients.</p> <p>You didn't write this bug. The architecture did.</p> <h2> Why This Happens </h2> <p>The <code>sentry-zerolog</code> integration stores a single <code>Hub</code> inside the<br> <code>Writer</code> struct, initialized once at construction time:</p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code> go type Writer struct { hub *sentry.Hub // fixed at creation — shared across ALL goroutines levels []zerolog.Level </code></pre> </div> go security hipaa devops