Expected Findings
- Sentry DSN allows arbitrary event ingestion into the production project.
- PostHog write key allows event spoofing.
- Datadog client token gives RUM ingestion across services.
Telemetry Bundle
Sentry / Telemetry Keys
Frontend boot exposes a Sentry DSN with project-write rights, a PostHog write key, and an internal Datadog client token.
Telemetry config
Primary Flows
- Telemetry bundle Includes DSNs and tokens
- Live snapshot Shows recent ingest
Signals
DSN
Sentry.init({ dsn: "https://abc123@sentry.io/4242" })