Is it safe to let a coding agent read your production errors?

Production errors can carry your users' data: emails, IP addresses, request URLs. Before you let Claude Code, Cursor or another agent read them, it's fair to ask where that data goes and what the agent can do with it. Here is exactly how Runheed handles it.

What gets stored

Only what your code sends: the error type and message, stack frames, breadcrumbs, environment and release, the agent context (agent, session, tool), request method, URL and headers, and any user id, email, IP or extra fields your code attaches. You decide all of it.

What is redacted automatically

Authorization, cookie and API-key headers are replaced with [REDACTED] the moment an event arrives, before it is stored or shown to an agent.

Strip anything else before it leaves your app

Both SDKs run a hook on every event before it is sent. Remove fields you'd rather keep in-house, or drop the event entirely.

import runheed from 'runheed';

runheed.init({
  dsn: process.env.RUNHEED_DSN,
  // Runs before anything leaves your app. Edit the event, or return null to drop it.
  beforeSend(event) {
    if (event.user) event.user = { id: event.user.id }; // keep the id, drop email and IP
    return event;
  },
});

import os, runheed

def before_send(event):
    # Runs before anything leaves your app. Edit the event, or return None to drop it.
    event.user = None  # drop the user's id, email and IP
    return event

runheed.init(dsn=os.environ["RUNHEED_DSN"], before_send=before_send)

What the agent can and can't do

The MCP server gives your agent nine tools. Six only read: search errors, get one error, recent errors, trends, the full context of an error and a project health score. Three change an error's status (resolve, ignore, unignore), and each can be flipped back. Nothing in Runheed can edit your code, deploy, or reach your servers. Your agent fixes code in your editor, under the permissions you gave it there.

Where the data goes when your agent reads it

When Claude Code or Cursor reads an error, that text goes to the AI tool you connected, under that tool's own terms. Runheed itself does not sell event data, use it for advertising, or use it to train AI models.

Keys, retention and deletion

• Agent keys are stored as SHA-256 hashes. Revoke a key, or disconnect an app that signed in with OAuth, and its access ends.
• Events are deleted after your plan's history window (30, 90 or 180 days).
• Traffic is encrypted with TLS. Ask hello@greatwork.company to delete your account and its events at any time.

Questions

Can the agent change my code or my app through Runheed?

No. Runheed's MCP tools read errors and change an error's status (resolved, ignored, unresolved), which can be flipped back. Code changes happen in your editor, under your agent's own permissions.

Are passwords and tokens in request headers stored?

Authorization, cookie and API-key headers are replaced with [REDACTED] when an event arrives, before it is stored.

Is my error data used to train AI models?

No. Runheed does not sell event data, use it for advertising, or use it to train AI models. When your agent reads an error, that text goes to the AI tool you connected, under that tool's terms.

How long are errors kept?

Events are deleted after your plan's history window: 30 days on Solo, 90 on Pro, 180 on Scale. You can ask for your account and its events to be deleted at any time.

How do I cut off an agent?

Revoke its agent key in Settings, or disconnect the app if it signed in with OAuth. Keys are stored as SHA-256 hashes, so they can be revoked but never read back.

Full details are in the privacy policy. Ready to connect your agent? Pick your client.