Sentry helps teams collect errors, releases, and performance data. A self-hosted deployment may also expose organization administration, project settings, issue tracking, and API tokens. A public page carrying the Sentry name could belong to a cloud tenant, a self-hosted instance, a login screen, or documentation. Discovery becomes useful only after an owner distinguishes those cases.
A count-only ZoomEye measurement on 2026-10-29 returned 40,396 matches for title="Sentry" and 767 for app="Sentry". Both used sub_type=all, page 1, and page size 1. The title result is the larger observation and therefore the selected discovery query. It is broad. It can include unrelated pages that use the word as a brand, product reference, or issue description. These are not confirmed vulnerable installations.
Start with identity and project boundaries
Sentry documentation describes authentication tokens that act as a user or organization account. API scopes govern actions such as project reads, project writes, organization administration, and releases. Organization and team membership also affect which projects a member can access when open membership is disabled. A project label does not guarantee read-only scope.
An owner should inventory self-hosted web endpoints separately from the public ingestion endpoints used by SDKs. The ingestion path needs to accept events, while the staff interface should be restricted to administrators and authorized users. A reverse proxy rule that exposes one path too broadly can make the other path unreachable or expose the administration surface to an unintended network.
For each self-hosted organization, review SSO, SCIM provisioning, project membership, team assignment, and API token scopes. Sentry supports SCIM for federated identity management, including member deletion. A member removed from the identity provider should lose application access through the documented provisioning workflow. Test the result by using the user's existing token after deactivation.
Interpret the field difference carefully
The 767 application matches provide a narrower product signature, while the title count is much larger. Do not subtract the two numbers and call the remainder unmanaged. A product fingerprint may require a specific banner, favicon, header, or route, and a self-hosted deployment can be customized behind a reverse proxy. A title can be added to a page that has nothing to do with Sentry.
Use the large title set to find likely web surfaces, then check a small sample for a Sentry route, a certificate, an HTML asset, or another reliable product clue. Use the application set to prioritize candidates with a stronger product signature. Both sets need the same ownership check before they can support an exposure statement.
If an exact count is used in an internal review, state the time and scope beside it. A later query with a country filter will produce a different total because the population changed. Compare like with like. Avoid measuring a global title count as if it were an organization's service inventory.
Review tokens as production credentials
List organization tokens, personal tokens, DSNs, and integration credentials. A DSN is intended to accept event data, but that does not make every DSN safe to publish if it allows unwanted event volume or reveals project identity. API tokens can read issues, releases, source maps, and project configuration. Assign the smallest scope that supports the integration and set an expiry where the platform supports one.
Check whether project visibility matches the team that owns the product. A developer debugging one service should not automatically see every team's error data. Review source map upload credentials and make sure the deployment pipeline can rotate them without breaking production. Store tokens in a secret manager rather than a build log or a repository variable that masks output but still exposes the value to every job.
The external count helps a team find candidates that its DNS and cloud inventories missed. The internal review determines whether a candidate is a Sentry deployment, whether its staff interface should be reachable, and what its tokens authorize. That sequence keeps discovery separate from an unsupported claim of compromise.