🛡️ Bright Security Scan by bararchy · Pull Request #11 · NeuraLegion/sentry

bararchy · 2026-06-07T21:03:45Z

🛡️ Bright Security Scan

Scan target: repository root at http://localhost:9000

✅ Detecting tech stack and starting the application

Application running at http://localhost:9000 (repository root)
✅ Setting up Bright security scanner and Repeater
Repeater connected
✅ Preparing application for security scanning
Patched Sentry's source ratelimit middleware to fail open and added self-hosted config changes to remove CSRF middleware and raise rate limits, rebuilt the app, but rapid POST v…
✅ Detecting authentication requirements
Auth configured (after non-infra retry)
✅ Analyzing source code for endpoints and parameters
875 endpoints (static analysis)
✅ Registering API endpoints for scanning
844 live entrypoints after pruning 404s
✅ Selecting relevant security tests per endpoint
Created 10 scan group(s) with per-endpoint test selection
✅ Fixing 1 vulnerabilities — round 4 (gpt-5.4) (4 attempts)
Round 4: 1 fix(es) applied, 0 skipped — model: gpt-5.4
✅ Running targeted validation scans — round 5 (5 attempts)
Round 5 validation — 0/1 fixed, 1 remaining (1 High)
🔄 Reached 5 rounds. 0/1 fixed, 1 remaining. 4 total fixes applied.

Findings

Severity	Vulnerability	Endpoint	Status
High	[BL] Excessive Data Exposure	`GET http://localhost:9000/1/default/releases/token/`	🔴 Open

github-actions · 2026-06-08T10:02:07Z

🚨 Warning: This pull request contains Frontend and Backend changes!

It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently.

Have questions? Please ask in the #discuss-dev-infra channel.

github-actions · 2026-06-08T10:50:29Z

Backend Test Failures

Failures on a4c4b7c in this run:

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InControlMode::test_enforce_rate_limit_is_false

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:223: in test_enforce_rate_limit_is_false
    assert request.rate_limit_category is None
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
E   AttributeError: 'WSGIRequest' object has no attribute 'rate_limit_category'

tests/sentry/middleware/test_ratelimit_middleware.py::TestRatelimitHeader::test_header_counts — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:539: in test_header_counts
    assert int(response["X-Sentry-Rate-Limit-Remaining"]) == 1
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.venv/lib/python3.13/site-packages/django/http/response.py:204: in __getitem__
    return self.headers[header]
           ^^^^^^^^^^^^^^^^^^^^
.venv/lib/python3.13/site-packages/django/utils/datastructures.py:308: in __getitem__
    return self._store[key.lower()][1]
           ^^^^^^^^^^^^^^^^^^^^^^^^
E   KeyError: 'x-sentry-rate-limit-remaining'

tests/sentry/issues/endpoints/test_group_details.py::GroupDetailsTest::test_ratelimit — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/issues/endpoints/test_group_details.py:229: in test_ratelimit
    assert response.status_code == 429
E   assert 500 == 429
E    +  where 500 = <Response status_code=500, "application/json">.status_code

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest::test_impersonation_uses_normalized_rate_limit

— log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:408: in test_impersonation_uses_normalized_rate_limit
    assert rate_limit_check_mock.called
E   AssertionError: assert False
E    +  where False = <MagicMock name='above_rate_limit_check' id='140194451826944'>.called

tests/sentry/middleware/test_ratelimit_middleware.py::TestConcurrentRateLimiter::test_concurrent_request_rate_limiting — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:629: in test_concurrent_request_rate_limiting
    limits = sorted(int(r["X-Sentry-Rate-Limit-ConcurrentRemaining"]) for r in results)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
tests/sentry/middleware/test_ratelimit_middleware.py:629: in <genexpr>
    limits = sorted(int(r["X-Sentry-Rate-Limit-ConcurrentRemaining"]) for r in results)
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.venv/lib/python3.13/site-packages/django/http/response.py:204: in __getitem__
    return self.headers[header]
           ^^^^^^^^^^^^^^^^^^^^
.venv/lib/python3.13/site-packages/django/utils/datastructures.py:308: in __getitem__
    return self._store[key.lower()][1]
           ^^^^^^^^^^^^^^^^^^^^^^^^
E   KeyError: 'x-sentry-rate-limit-concurrentremaining'

tests/sentry/core/endpoints/test_project_transfer.py::ProjectTransferTest::test_rate_limit_with_override — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/core/endpoints/test_project_transfer.py:106: in test_rate_limit_with_override
    assert response.status_code == 429
E   assert 404 == 429
E    +  where 404 = <Response status_code=404, "application/json">.status_code

tests/sentry/issues/endpoints/test_group_details.py::GroupUpdateTest::test_ratelimit — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/issues/endpoints/test_group_details.py:772: in test_ratelimit
    assert response.status_code == 429
E   assert 200 == 429
E    +  where 200 = <Response status_code=200, "application/json">.status_code

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest::test_enforce_rate_limit_is_false — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:223: in test_enforce_rate_limit_is_false
    assert request.rate_limit_category is None
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
E   AttributeError: 'WSGIRequest' object has no attribute 'rate_limit_category'

tests/sentry/middleware/test_stats.py::RequestTimingMiddlewareTest::test_records_default_api_metrics_with_rate_limit_type

— log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_stats.py:70: in test_records_default_api_metrics_with_rate_limit_type
    incr.assert_called_with(
/opt/hostedtoolcache/Python/3.13.1/x64/lib/python3.13/unittest/mock.py:977: in assert_called_with
    raise AssertionError(_error_message()) from cause
E   AssertionError: expected call not found.
E   Expected: incr('view.response', instance='/', tags={'method': 'GET', 'status_code': 429, 'ui_request': False, 'rate_limit_type': 'fixed_window', 'url_name': 'sentry'}, skip_internal=False)
E     Actual: incr('view.response', instance='/', tags={'method': 'GET', 'status_code': 429, 'ui_request': False, 'rate_limit_type': None, 'url_name': 'sentry'}, skip_internal=False)

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InControlMode::test_positive_rate_limit_response_headers

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:121: in test_positive_rate_limit_response_headers
    assert request.will_be_rate_limited
E   AssertionError: assert False
E    +  where False = <WSGIRequest: GET '/'>.will_be_rate_limited

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InCellMode::test_impersonation_enforces_rate_limits_when_disabled

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:243: in test_impersonation_enforces_rate_limits_when_disabled
    assert response is not None
E   assert None is not None

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InCellMode::test_positive_rate_limit_response_headers

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:121: in test_positive_rate_limit_response_headers
    assert request.will_be_rate_limited
E   AssertionError: assert False
E    +  where False = <WSGIRequest: GET '/'>.will_be_rate_limited

tests/snuba/api/endpoints/test_organization_eventid.py::EventIdLookupEndpointTest::test_ratelimit — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/snuba/api/endpoints/test_organization_eventid.py:62: in test_ratelimit
    assert resp.status_code == 429
E   assert 500 == 429
E    +  where 500 = <Response status_code=500, "application/json">.status_code

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InCellMode::test_impersonation_with_custom_endpoint_config

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:298: in test_impersonation_with_custom_endpoint_config
    assert response is not None
E   assert None is not None

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InCellMode::test_rate_limit_category — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:200: in test_rate_limit_category
    assert request.rate_limit_category is None
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
E   AttributeError: 'WSGIRequest' object has no attribute 'rate_limit_category'

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest::test_positive_concurrent_rate_limit_response_headers

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:152: in test_positive_concurrent_rate_limit_response_headers
    assert request.will_be_rate_limited
E   AssertionError: assert False
E    +  where False = <WSGIRequest: GET '/'>.will_be_rate_limited

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest::test_positive_rate_limit_response_headers — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:121: in test_positive_rate_limit_response_headers
    assert request.will_be_rate_limited
E   AssertionError: assert False
E    +  where False = <WSGIRequest: GET '/'>.will_be_rate_limited

tests/sentry/users/api/endpoints/test_auth_index.py::AuthVerifyEndpointTest::test_rate_limit — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/users/api/endpoints/test_auth_index.py:196: in test_rate_limit
    assert response.status_code == 429
E   assert 403 == 429
E    +  where 403 = <Response status_code=403, "application/json">.status_code

tests/sentry/users/api/endpoints/test_user_password.py::UserPasswordTest::test_rate_limit — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/users/api/endpoints/test_user_password.py:135: in test_rate_limit
    self.get_error_response(
src/sentry/testutils/cases.py:663: in get_error_response
    assert_status_code(response, status_code)
src/sentry/testutils/asserts.py:46: in assert_status_code
    assert minimum <= response.status_code < maximum, response
E   AssertionError: <Response status_code=400, "application/json">
E   assert 429 <= 400
E    +  where 400 = <Response status_code=400, "application/json">.status_code

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InCellMode::test_impersonation_uses_normalized_rate_limit

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:408: in test_impersonation_uses_normalized_rate_limit
    assert rate_limit_check_mock.called
E   AssertionError: assert False
E    +  where False = <MagicMock name='above_rate_limit_check' id='139799631495584'>.called

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InControlMode::test_impersonation_rate_limit_uses_actual_user

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:317: in test_impersonation_rate_limit_uses_actual_user
    assert hasattr(request, "rate_limit_key")
E   AssertionError: assert False
E    +  where False = hasattr(<WSGIRequest: GET '/'>, 'rate_limit_key')

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InControlMode::test_positive_concurrent_rate_limit_response_headers

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:152: in test_positive_concurrent_rate_limit_response_headers
    assert request.will_be_rate_limited
E   AssertionError: assert False
E    +  where False = <WSGIRequest: GET '/'>.will_be_rate_limited

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InCellMode::test_positive_concurrent_rate_limit_response_headers

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:152: in test_positive_concurrent_rate_limit_response_headers
    assert request.will_be_rate_limited
E   AssertionError: assert False
E    +  where False = <WSGIRequest: GET '/'>.will_be_rate_limited

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InControlMode::test_impersonation_with_custom_endpoint_config

— log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:298: in test_impersonation_with_custom_endpoint_config
    assert response is not None
E   assert None is not None

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest::test_impersonation_rate_limit_uses_actual_user

— log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:317: in test_impersonation_rate_limit_uses_actual_user
    assert hasattr(request, "rate_limit_key")
E   AssertionError: assert False
E    +  where False = hasattr(<WSGIRequest: GET '/'>, 'rate_limit_key')

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InControlMode::test_positive_rate_limit_check

— log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:99: in test_positive_rate_limit_check
    assert request.will_be_rate_limited
E   AssertionError: assert False
E    +  where False = <WSGIRequest: GET '/'>.will_be_rate_limited

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InCellMode::test_enforce_rate_limit_is_false

— log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:223: in test_enforce_rate_limit_is_false
    assert request.rate_limit_category is None
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
E   AttributeError: 'WSGIRequest' object has no attribute 'rate_limit_category'

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest::test_positive_rate_limit_check — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:99: in test_positive_rate_limit_check
    assert request.will_be_rate_limited
E   AssertionError: assert False
E    +  where False = <WSGIRequest: GET '/'>.will_be_rate_limited

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest::test_rate_limit_category — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:200: in test_rate_limit_category
    assert request.rate_limit_category is None
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
E   AttributeError: 'WSGIRequest' object has no attribute 'rate_limit_category'

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InCellMode::test_positive_rate_limit_check

— log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:99: in test_positive_rate_limit_check
    assert request.will_be_rate_limited
E   AssertionError: assert False
E    +  where False = <WSGIRequest: GET '/'>.will_be_rate_limited

tests/sentry/web/frontend/test_auth_login.py::AuthLoginTest::test_login_ratelimited_ip_gets — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/web/frontend/test_auth_login.py:101: in test_login_ratelimited_ip_gets
    assert resp.status_code == 429
E   assert 200 == 429
E    +  where 200 = <HttpResponse status_code=200, "text/html">.status_code

tests/sentry/middleware/test_access_log_middleware.py::TestAccessLogRateLimited__InCellMode::test_access_log_rate_limited

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_access_log_middleware.py:280: in test_access_log_rate_limited
    self.get_error_response(status_code=429)
src/sentry/testutils/cases.py:663: in get_error_response
    assert_status_code(response, status_code)
src/sentry/testutils/asserts.py:46: in assert_status_code
    assert minimum <= response.status_code < maximum, response
E   AssertionError: <Response status_code=500, "application/json">
E   assert 500 < 430
E    +  where 500 = <Response status_code=500, "application/json">.status_code

tests/sentry/middleware/test_access_log_middleware.py::TestAccessLogRateLimited::test_access_log_rate_limited — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_access_log_middleware.py:280: in test_access_log_rate_limited
    self.get_error_response(status_code=429)
src/sentry/testutils/cases.py:663: in get_error_response
    assert_status_code(response, status_code)
src/sentry/testutils/asserts.py:46: in assert_status_code
    assert minimum <= response.status_code < maximum, response
E   AssertionError: <Response status_code=500, "application/json">
E   assert 500 < 430
E    +  where 500 = <Response status_code=500, "application/json">.status_code

tests/sentry/middleware/test_access_log_middleware.py::TestAccessLogConcurrentRateLimited::test_concurrent_request_finishes

— log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_access_log_middleware.py:303: in test_concurrent_request_finishes
    assert self.captured_logs[0].group == RateLimitedEndpoint.rate_limits.group
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
E   AttributeError: 'LogRecord' object has no attribute 'group'

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InControlMode::test_rate_limit_category — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:200: in test_rate_limit_category
    assert request.rate_limit_category is None
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
E   AttributeError: 'WSGIRequest' object has no attribute 'rate_limit_category'

tests/sentry/middleware/test_ratelimit_middleware.py::TestRatelimitHeader::test_header_race_condition — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:586: in test_header_race_condition
    assert int(response["X-Sentry-Rate-Limit-Remaining"]) == 1
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.venv/lib/python3.13/site-packages/django/http/response.py:204: in __getitem__
    return self.headers[header]
           ^^^^^^^^^^^^^^^^^^^^
.venv/lib/python3.13/site-packages/django/utils/datastructures.py:308: in __getitem__
    return self._store[key.lower()][1]
           ^^^^^^^^^^^^^^^^^^^^^^^^
E   KeyError: 'x-sentry-rate-limit-remaining'

tests/sentry/middleware/test_ratelimit_middleware.py::TestConcurrentRateLimiter::test_request_finishes — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:604: in test_request_finishes
    int(response["X-Sentry-Rate-Limit-ConcurrentRemaining"])
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.venv/lib/python3.13/site-packages/django/http/response.py:204: in __getitem__
    return self.headers[header]
           ^^^^^^^^^^^^^^^^^^^^
.venv/lib/python3.13/site-packages/django/utils/datastructures.py:308: in __getitem__
    return self._store[key.lower()][1]
           ^^^^^^^^^^^^^^^^^^^^^^^^
E   KeyError: 'x-sentry-rate-limit-concurrentremaining'

tests/sentry/ratelimits/utils/test_enforce_rate_limit.py::EnforceRateLimitTest::test_enforced_rate_limit — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/ratelimits/utils/test_enforce_rate_limit.py:49: in test_enforced_rate_limit
    self.get_error_response(status_code=status.HTTP_429_TOO_MANY_REQUESTS)
src/sentry/testutils/cases.py:663: in get_error_response
    assert_status_code(response, status_code)
src/sentry/testutils/asserts.py:46: in assert_status_code
    assert minimum <= response.status_code < maximum, response
E   AssertionError: <Response status_code=200, "application/json">
E   assert 429 <= 200
E    +  where 200 = <Response status_code=200, "application/json">.status_code

tests/sentry/issues/endpoints/test_group_tagkey_values.py::GroupTagKeyValuesTest::test_ratelimit — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/issues/endpoints/test_group_tagkey_values.py:331: in test_ratelimit
    assert response.status_code == 429
E   assert 200 == 429
E    +  where 200 = <Response status_code=200, "application/json">.status_code

tests/sentry/middleware/test_access_log_middleware.py::TestAccessLogRateLimited__InControlMode::test_access_log_rate_limited

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_access_log_middleware.py:280: in test_access_log_rate_limited
    self.get_error_response(status_code=429)
src/sentry/testutils/cases.py:663: in get_error_response
    assert_status_code(response, status_code)
src/sentry/testutils/asserts.py:46: in assert_status_code
    assert minimum <= response.status_code < maximum, response
E   AssertionError: <Response status_code=500, "application/json">
E   assert 500 < 430
E    +  where 500 = <Response status_code=500, "application/json">.status_code

tests/sentry/middleware/test_access_log_middleware.py::TestAccessLogConcurrentRateLimited__InCellMode::test_concurrent_request_finishes

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_access_log_middleware.py:303: in test_concurrent_request_finishes
    assert self.captured_logs[0].group == RateLimitedEndpoint.rate_limits.group
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
E   AttributeError: 'LogRecord' object has no attribute 'group'

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InControlMode::test_impersonation_enforces_rate_limits_when_disabled

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:243: in test_impersonation_enforces_rate_limits_when_disabled
    assert response is not None
E   assert None is not None

tests/sentry/middleware/test_ratelimit_middleware.py::RatelimitMiddlewareTest__InCellMode::test_impersonation_rate_limit_uses_actual_user

— log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/middleware/test_ratelimit_middleware.py:317: in test_impersonation_rate_limit_uses_actual_user
    assert hasattr(request, "rate_limit_key")
E   AssertionError: assert False
E    +  where False = hasattr(<WSGIRequest: GET '/'>, 'rate_limit_key')

BrightSec added 2 commits June 8, 2026 00:03

chore: initialize Bright security scan

3af4422

fix: high — [BL] Excessive Data Exposure

11cdb53

github-actions Bot added the Scope: Backend label Jun 8, 2026

fix: high — [BL] Excessive Data Exposure

f8c848c

github-actions Bot added the Scope: Frontend label Jun 8, 2026

BrightSec added 3 commits June 8, 2026 13:14

fix: high — [BL] Excessive Data Exposure

33c34c7

fix: high — [BL] Excessive Data Exposure

bc5a525

fix: Bright security scan remediations

34bd0f8

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🛡️ Bright Security Scan#11

🛡️ Bright Security Scan#11
bararchy wants to merge 6 commits into
masterfrom
bright-scan-1780866215001

bararchy commented Jun 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 8, 2026

Uh oh!

github-actions Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

bararchy commented Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!