sentry-policy-guardrails

# Sentry Policy Guardrails ## Overview Organizational governance framework that prevents Sentry configuration drift across multiple services. A shared npm package (`@company/sentry-config`) wraps `Sentry.init()` to enforce PII scrubbing, naming conventions, tagging standards, and per-tier trace rate caps. CI checks block policy violations before merge, and a monthly drift audit detects projects that have fallen out of compliance. ## Prerequisites - `@sentry/node` v8+ installed in target services - Internal npm registry available (GitHub Packages, Artifactory, or similar) - Team structure and project ownership defined in Sentry - `SENTRY_AUTH_TOKEN` with `org:read` and `project:read` scopes - Compliance requirements identified (SOC 2, GDPR, HIPAA) ## Instructions ### Step 1 — Build the Shared Configuration Package Create `@company/sentry-config` that wraps `Sentry.init()` with non-negotiable defaults. **Mandatory PII scrubbing (cannot be bypassed):** ```typescript // @company/sentry-config/src/scrubbers.ts import type { Event } from '@sentry/node'; const SENSITIVE_HEADERS = [ 'authorization', 'cookie', 'set-cookie', 'x-api-key', 'x-auth-token', 'x-csrf-token', ]; const PII_PATTERNS = [ { pattern: /\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{1,7}\b/g, replacement: '[CC_REDACTED]' }, { pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, replacement: '[EMAIL_REDACTED]' }, { pattern: /\b\d{3}-\d{2}-\d{4}\b/g, replacement: '[SSN_REDACTED]' }, ]; export functi...