Breadcrumbs bypass IExceptionFilter, leaking filtered exception messages into later events

Package

Sentry

.NET Flavor

.NET

.NET Version

10.0.400

OS

Any (not platform specific)

OS Version

10.0

Development Environment

Rider 2025.x (Windows)

SDK Version

6.9.0

Self-Hosted Sentry Version

No response

Workload Versions

UseSentry or SentrySdk.Init call

SentrySdk.Init(o =>
{
    o.Dsn = "https://key@o0.ingest.sentry.io/0"; // any DSN; nothing is actually sent below
    o.AddExceptionFilterForType<MyException>();

    // Only here to inspect what would be sent
    o.SetBeforeSend((e, _) =>
    {
        Console.WriteLine($"BeforeSend: {e.Message?.Formatted ?? e.Message?.Message ?? e.Exception?.Message}");
        foreach (var b in e.Breadcrumbs ?? new List<Breadcrumb>())
        {
            Console.WriteLine($"  breadcrumb: [{b.Category}] {b.Message}");
        }
        return null;
    });
});

Steps to Reproduce

using Sentry;

class MyException : Exception
{
    public MyException(string m) : base(m) { }
}

class Program
{
    static void Main()
    {
        using var _ = SentrySdk.Init(o => { /* see above */ });

        // Doesn't have to be an explicit CaptureException, it can be reproduced with implicit unhandled exceptions too
        SentrySdk.CaptureException(new MyException("secret exception message"));

        SentrySdk.CaptureMessage("some later unrelated event");
    }
}

Register an exception filter for MyException.
Capture a MyException - it's filtered out as expected.
Capture any later, unrelated event (message or more likely a span).

repro.zip

Expected Result

An exception dropped by an IExceptionFilter leaves no trace.
No breadcrumb carrying its message on subsequent events.

Actual Result

The later event carries a breadcrumb with the filtered exception's message:

BeforeSend: some later unrelated event
  breadcrumb: [Exception] secret exception message

NET-794

It is possible to filter/process breadcrumbs before they are sent. But at this point we lost exception context and its type, forcing filtering by a string alone.

And speaking of that, Sentry Scrubbing doesn't have an option to scrub breadcrumbs as it seems - no $breadcrumb defined in the Source list. I tried to set [Mask] [Usernames in filepaths] from [$breadcrumb] blindly, but it didn't seem to scrub anything.

@maxkatz6

Hi @maxkatz6 - interesting problem. I'll do some digging to see it there is already an established way to avoid this in other SDKs.

Sentry Scrubbing doesn't have an option to scrub breadcrumbs as it seems - no $breadcrumb defined in the Source list.

Not sure I follow... what are you configuring where and what are you seeing vs what you expect?

@maxkatz6

@maxkatz6 I've added a solution roughly based on what we do in the sentry-java SDK... there, they don't actually create breadcrumbs for all exceptions but they do when the exception gets captured via one of the logging integrations. In that scenario, they pass the log into the BeforeBreadcrumb callback as a Hint.

In sentry-dotnet we add breadcrumbs for exceptions regardless of whether these get captured via the logging API, by one of our integrations or whether you capture them manually. So for .NET I figured we could pass the Exception itself in to the callback as a Hint:

feat: Provide the exception in the Hint passed to BeforeBreadcrumb #5523

@jamescrosswell

@jamescrosswell thanks. Yes, BeforeBreadcrumb filtration + exception hint works for me.

Not sure I follow... what are you configuring where and what are you seeing vs what you expect?

I was talking about https://****.sentry.io/settings/security-and-privacy/ "Advanced Data Scrubbing" section. Doesn't seem to be possible to scrub breadcrumbs contents, unless I miss something. But it's not a .NET client issue.

BeforeBreadcrumb filtration + exception hint works for me.

Cool, thanks for validating 👍🏻

https://****.sentry.io/settings/security-and-privacy/ "Advanced Data Scrubbing" section. Doesn't seem to be possible to scrub breadcrumbs contents

Aha, I see. Possibly something to raise with the core product team.

Navigation Menu

Repository navigation

Breadcrumbs bypass IExceptionFilter, leaking filtered exception messages into later events #5514

Package

.NET Flavor

.NET Version

OS

OS Version

Development Environment

Other Error Monitoring Solution

Other Error Monitoring Solution Name

SDK Version

Self-Hosted Sentry Version

Workload Versions

UseSentry or SentrySdk.Init call

Steps to Reproduce

Expected Result

Actual Result

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Breadcrumbs bypass IExceptionFilter, leaking filtered exception messages into later events #5514

Description

Package

.NET Flavor

.NET Version

OS

OS Version

Development Environment

Other Error Monitoring Solution

Other Error Monitoring Solution Name

SDK Version

Self-Hosted Sentry Version

Workload Versions

UseSentry or SentrySdk.Init call

Steps to Reproduce

Expected Result

Actual Result

Activity

linear-code commented on Aug 27, 2026

maxkatz6 commented on Aug 27, 2026

jamescrosswell commented on Aug 31, 2026

jamescrosswell commented on Aug 31, 2026

maxkatz6 commented on Sep 1, 2026

jamescrosswell commented on Sep 1, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions