Remote Code Execution on a Facebook server
Hey, developer of Sentry here. We're submitting a patch that prevents showing any settings on this DEBUG page.I'd like to mention that we never suggest running Sentry in DEBUG mode, nor do we document how to do this. Sentry does use Django, so it's pretty easy to put pieces together and figure out how to do it.So while we can help obfuscate this specific issue, running in DEBUG mode always has the potential to surface insecure information due to the nature of it.Our patch to suppress this information entirely can be found here: https://github.com/getsentry/sentry/pull/9516