We've fixed a bug in Relay where the following span attributes were excluded from data scrubbing, regardless of project or organization data scrubbing rules:

• http.query
• url.query
• url.full

The issue was caused by a missing default PII annotation on Relay's SpanData struct, which caused these fields to be treated as non-sensitive. The http.query and url.query attributes were introduced in #5784, which exposed the pre-existing mis-categorization on url.full. We've also updated our documentation to better clarify how sendDefaultPii functions with respect to request query strings.

If you were relying on default scrubbing for these fields and use one of the affected SDKs you should review historical data and consider whether sensitive values may have been retained.

Please see our Security Advisory on GitHub for full details.