PII scrubbing
Redacted before it's ever enqueued, let alone stored
A likely-sensitive value never reaches the job queue in the first place, only the request that reported it -- key-name matches and shape-based pattern matching, combined, before anything is persisted.
Scrubbed before enqueueing, not in the background job
Redaction runs in the ingestion controller itself, before the event is ever handed to a background job -- specifically so a raw value never gets serialized into the job queue's own storage either, only ever existing in memory for the span of that one request. Structured fields an app sets deliberately (exception class, environment, release, server name) are left alone entirely; only the free-text fields an app didn't fully control the contents of -- message, backtrace, context, tags -- go through scrubbing at all.
Two independent signals, combined
A value is redacted wholesale if its own field name matches a known-sensitive key (password, token, api_key, credit_card, ssn, and similar) -- the highest-confidence signal available: an app author who names a field credit_card is telling us, in plain language, what's in it. Separately, free text is scanned against a set of deliberately conservative shape-based patterns: emails, SSNs, formatted credit card numbers, bearer tokens, JWTs, and known API key formats (AWS, Stripe, GitHub).
Credit cards only match the formatted 4-4-4-4 shape, on purpose, not any bare run of 13-16 digits -- this app's own domain is full of legitimate long numeric ids in exception messages ("Couldn't find Invoice with id=88214451") that a looser pattern would wrongly redact and make the product worse at the one thing it exists to do.
Extend the key list per project, never the pattern matching
A project can add its own sensitive field names on top of the built-in defaults -- patient_mrn for a healthcare app, say -- but deliberately can't extend the shape-based pattern matching itself with arbitrary custom regexes; that's its own can of worms (a slow, denial-of-service-prone pattern is a real risk when the pattern itself is user-supplied). Available on every plan, uniformly, not gated.