Sensitive URL query params leak to Sentry in transaction events #25247

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/browser

SDK Version

10.76.2

Framework Version

No response

Link to Sentry event

No response

Reproduction Example/SDK Setup

I set the tracesSampleRate to 1, and dataCollection.userInfo to false; otherwise didn't configure dataCollection.

Steps to Reproduce

Load a page with a sensitive URL query param, such as "?jwt=baz", and analyze the transaction event sent to Sentry.

Expected Result

I would have assumed that the sensitive query param would be filtered.

Actual Result

The value of the sensitive query param is sent to Sentry in span descriptions as well as the transaction's request.url property.

Additional Context

I believe this does work correctly on the 11.x branch; this is a bug report for the 10.x branch.

Priority

No response