docs(security): recommend set_user_info false in production

[HecFranco]

Summary

• SECURITY.md: recommend set_user_info: false in production; session_id already false
• Recipe comment for integrators
• Docs-only for cookie scrub (BeforeSendHandler change not trivial)

Fixes #16

Test plan

• Review docs/code diffs for accuracy
• Confirm no unintended scope beyond this security remediation
• CI green on this branch

Made with Cursor

Summary by CodeRabbit

• Documentation
  • Added production security guidance for disabling user information collection.
  • Clarified that session ID collection remains disabled by default.
  • Documented configuration and server-side scrubbing recommendations for sensitive request data.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 23dd5ef3-2608-49b7-94ed-bb2ddb8fdb3e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The security guide adds production recommendations for disabling set_user_info, retaining the default-disabled set_session_id, and scrubbing sensitive request data.

Changes

Security documentation

Layer / File(s)	Summary
Production Sentry settings docs/SECURITY.md	Adds a when@prod example that disables user identity and session IDs in Sentry events. Documents session correlation conditions and request-data scrubbing guidance.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The documentation objectives are covered, but the required recipe comment is in an excluded file and cannot be verified.	Review .symfony/recipes/nowo-tech/sentry-bundle/1.0.0/config/packages/nowo_sentry.yaml to verify the production recommendation comment.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The documented changes align with the linked issue objectives and show no unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main security documentation change: recommending set_user_info: false in production.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/prod-user-info-docs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.