From 3073863f434243c8ec9ea10d251f153e7caa3a02 Mon Sep 17 00:00:00 2001
From: Richie McIlroy <33632126+richiemcilroy@users.noreply.github.com>
Date: Fri, 13 Nov 2026 02:58:03 -0500
Subject: [PATCH] fix(web): send no trace headers on outgoing server requests

Server and edge tracing are off (tracesSampleRate 0), so the sentry-trace
and baggage headers Sentry adds to outgoing requests are never used. Some
of those requests go to customers' own servers, such as Cap Infra webhook
deliveries, which then receive the release and project details those
headers carry. tracePropagationTargets is now empty. Error reporting is
unchanged, and browsers can still send the headers to Cap.
---
 .../unit/sentry-server-propagation.test.ts    | 29 +++++++++++++++++++
 apps/web/sentry.edge.config.ts                |  3 ++
 apps/web/sentry.server.config.ts              |  3 ++
 3 files changed, 35 insertions(+)
 create mode 100644 apps/web/__tests__/unit/sentry-server-propagation.test.ts

diff --git a/apps/web/__tests__/unit/sentry-server-propagation.test.ts b/apps/web/__tests__/unit/sentry-server-propagation.test.ts
new file mode 100644
index 00000000000..8aee14dfd5f
--- /dev/null
+++ b/apps/web/__tests__/unit/sentry-server-propagation.test.ts
@@ -0,0 +1,29 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const init = vi.hoisted(() => vi.fn());
+vi.mock("@sentry/nextjs", () => ({ init }));
+
+describe("server Sentry setup", () => {
+	beforeEach(() => {
+		init.mockReset();
+		vi.resetModules();
+		vi.stubEnv(
+			"NEXT_PUBLIC_SENTRY_DSN",
+			"https://public@example.ingest.sentry.io/1",
+		);
+	});
+
+	it.each([
+		["node", "../../sentry.server.config"],
+		["edge", "../../sentry.edge.config"],
+	])(
+		"adds no trace headers to outgoing requests on the %s runtime",
+		async (_runtime, path) => {
+			await import(path);
+			expect(init).toHaveBeenCalledTimes(1);
+			const options = init.mock.calls[0]?.[0];
+			expect(options.tracePropagationTargets).toEqual([]);
+			expect(options.tracesSampleRate).toBe(0);
+		},
+	);
+});
diff --git a/apps/web/sentry.edge.config.ts b/apps/web/sentry.edge.config.ts
index d5c5f513bda..8e01ed89824 100644
--- a/apps/web/sentry.edge.config.ts
+++ b/apps/web/sentry.edge.config.ts
@@ -7,6 +7,9 @@ if (dsn) {
 		dsn,
 		sendDefaultPii: false,
 		tracesSampleRate: 0,
+		// Tracing is off, so the trace headers serve nothing on outgoing
+		// requests, and some of those go to customers' own servers.
+		tracePropagationTargets: [],
 		maxBreadcrumbs: 30,
 	});
 }
diff --git a/apps/web/sentry.server.config.ts b/apps/web/sentry.server.config.ts
index d5c5f513bda..8e01ed89824 100644
--- a/apps/web/sentry.server.config.ts
+++ b/apps/web/sentry.server.config.ts
@@ -7,6 +7,9 @@ if (dsn) {
 		dsn,
 		sendDefaultPii: false,
 		tracesSampleRate: 0,
+		// Tracing is off, so the trace headers serve nothing on outgoing
+		// requests, and some of those go to customers' own servers.
+		tracePropagationTargets: [],
 		maxBreadcrumbs: 30,
 	});
 }