weak crypto algorithm SHA-1

[remithaunay]

Problem Statement

Hello,

SHA-1 is considered a weak cryptographic algorithm, and a recent penetration test revealed its use, inside sentry-java.

Could you clarify how this algorithm is used and why its usage does not pose a security risk?
Do you plan to remove / update it ?

I found it there: https://github.com/search?q=repo%3Agetsentry%2Fsentry-java%20SHA-1&type=code

Thanks!

Solution Brainstorm

No response

[markushi]

@remithaunay thanks for reaching out! We only use SHA-1 to determine the local SDK cache folder name based on the project DSN. The hash itself is not used for data transmission or any other security related feature.
Hope this helps! We've opened a PR to clarify the usage.