Sentry scrubbing: logentry.params is not redacted, and three scrubbed fields have no test #369

Follow-up from shepherd review of #367 (which is otherwise sound — this is deliberately not a change to that PR, whose review has settled).

#367 put RedactAccountNames on the event path via BeforeSend / BeforeBreadcrumb. Two small things it leaves open, both found by probing the shipped options against a serialised envelope:

1. SentryMessage.Params passes through verbatim

AppLogger.ScrubAccountNames(SentryEvent) rebuilds the message as:

@event.Message = new SentryMessage
{
    Message   = RedactAccountNames(message.Message),
    Formatted = RedactAccountNames(message.Formatted),
    Params    = message.Params          // <- not scrubbed
};

Params serialises as logentry.params. Verified with a throwaway probe: an event whose Params holds /Users/octocat/run.csv ships that string in the envelope with the hook active.

Not currently reachable — nothing in the app calls CaptureMessage, so no event today carries a logentry. But it is exactly the shape #366 was: a redactor that is correct and simply is not on the path. The first CaptureMessage("... {0}", path) anyone adds would leak, silently, with no test to catch it.

Fix is one line: map the string elements of Params through RedactAccountNames (leaving non-string entries alone, as Extra already does).

2. Three fields are scrubbed but untested

#367's 19 tests assert on the envelope for the exception value, stack-frame filename/abs_path, extra string values and breadcrumbs[].message. The hook also scrubs, with no test pinning it:

• logentry (message / formatted)
• breadcrumb data values
• server_name

I confirmed by probe that all three are in fact scrubbed today, so this is coverage, not a leak. Worth pinning so a future edit to ScrubAccountNames cannot quietly drop one.

Worth knowing about server_name: with SendDefaultPii = false the SDK omits the field from the envelope entirely, so that line is genuinely belt-and-braces and a test for it has to assert absence rather than redaction.

Out of scope

tags remain unscrubbed by design (SetDeviceContext sends a device friendly name and an IP); that is a stated decision in AppLogger's remarks, and changing it is neither this issue nor #367. Server-side scrubbing is #100.