Sensitive request data stays off
Bodies, headers, IP addresses, query strings and SQL text are disabled in generated Django configuration.
Trust center / Security
Production context without collecting everything.
FetchNode uses scoped project keys, bounded payloads and conservative generated defaults. You decide when more context is appropriate for your application.
Browser and server keys are separated
Public browser keys cannot create release markers. Private server keys can be revoked and rotated per project.
Raw history has a defined lifetime
Plan retention is enforced for raw errors, traffic and analytics events. Project deletion invalidates remaining keys.
Capture matrix
What the default setup sends
SignalDefault
- Exception type, message and application stack frames
- On
- Django route, method, timing and internal user ID
- On
- Environment, release and bounded breadcrumbs
- On
- Headers, request body, query string and IP address
- Off
- SQL statement text
- Off
- Browser analytics before consent
- Off
Application controls
- • Per-project browser and server keys.
- • Key revocation, rotation and optional expiry.
- • Organization and project roles for dashboard access.
- • Bounded ingest size and per-project rate limiting.
- • Scanner-noise filtering before visible issue alerts.
Operational controls
- • HTTPS is required for production deployment.
- • Stripe hosts checkout and payment-method handling.
- • Readiness checks cover the database and configured cache.
- • Raw telemetry is cleaned up against plan retention.
- • Security concerns can be reported directly to the founder.
Report a security concern
Please do not include production secrets or customer data in the first message. Describe the affected surface and a safe way to reproduce the issue.
Contact the maintainer through GitHub first. Do not disclose vulnerability details in a public issue.