Variable: ALLOWED_SPAN_ATTRIBUTES

const ALLOWED_SPAN_ATTRIBUTES: ReadonlySet<string>

Defined in: packages/telemetry/src/allowlist.ts:20

The only span attribute keys that leave the process. A key outside the list is dropped, so a payload, a name, an e-mail address or a query string put on a span by an instrumentation or by a careless line cannot reach the collector (D1.11, chapter 28 section 8: identifiers, never personal data).

The list is closed and small on purpose. Widening it is a reviewed change: a key is added only when its value is an identifier, a code or a count.

Deliberately absent: url.full, url.query, http.url, http.target (query strings carry tokens), db.statement and db.query.text (literals), every http.request.header.* and http.response.header.*, exception.message and exception.stacktrace (messages quote values), user_agent.original, and every enduser.*.