# Scrub personal data before an event leaves the process

Error payloads carrying user data to a third party, scrubbed in-process before they are sent.

Category: Error reporting and triage
Source: https://letsship.ai/use-cases/scrub-personal-data-before-send
Published: 2026-08-25

## Goal

Remove personal data from error events before they leave the process.

## Acceptance criteria

- Scrubbing runs in-process, before transmission
- A test asserts each sensitive field is absent from the outbound payload
- Request bodies and query strings are covered, not just top-level fields
- The scrub list is defined in one place

## What lands as proof

A test that inspects the outbound payload and asserts each sensitive field is gone.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Scrub personal data from error events

Description: Remove personal data from error events before they leave the process.

Acceptance criteria:
- Scrubbing runs in-process, before transmission
- A test asserts each sensitive field is absent from the outbound payload
- Request bodies and query strings are covered, not just top-level fields
- The scrub list is defined in one place

Before you create the issue, look at what this repository currently attaches to error events and list any field that could carry user data.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: remove personal data from error events before they leave the process. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means assertions that the scrubbed fields never reach the tracker, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

The run stops once the plan is written. Somebody reads the approach and approves it before any code exists, which is the cheapest moment to redirect the work.