Originally published at runheed.com .

Five mistakes come up again and again in Python error reporting. Copying request headers sends Authorization and Cookie values to your tracker. Flask's errorhandler(Exception) also catches 404s and can turn them into 500s. A framework hook and a logging handler each report the same exception. Patching Thread.run misses every subclass that overrides run. And a dropped ThreadPoolExecutor future reports nothing at all. We hit the first four in Runheed's Python SDK, running it in real FastAPI, Flask and Django apps with fake secrets, after unit tests had passed.

Trap 1: copying request headers leaks secrets

Adding request context is the obvious next step, and dict(request.headers) is the obvious way to do it. In Starlette, FastAPI, Flask and Django that dict holds the caller's real Authorization and Cookie values, and query strings can hold tokens too. They then sit in your tracker in plain text.…