[agusumri]

Problem

redact_header() only matched five exact header names (authorization, cookie, proxy-authorization, set-cookie, x-api-key). Any other credential header passed with -H was written verbatim into the request field of the output, which is meant to be shareable evidence.

Before, with -H "X-Auth-Token: s3cr3t" -H "Cookie: c=1":

POST /index.php HTTP/1.1
Host: example.com
X-Auth-Token: s3cr3t          <- leaked
Cookie: <redacted>
X-Api-Key: <redacted>

After:

X-Auth-Token: <redacted>
Cookie: <redacted>
X-Api-Key: <redacted>

Change

• New SENSITIVE_HEADER_PATTERN matches credential-bearing name segments: auth, authorization, bearer, cookie, key, passwd, password, secret, session, token, plus apikey/accesskey. Segment boundaries keep ordinary headers such as X-Request-Id, X-Forwarded-For, and X-Keyboard-Layout untouched.
• New is_sensitive_header() is the single predicate, used by both redact_header() and the existing cross-origin redirect stripping in send_post(). A header worth hiding is also worth dropping when the scan follows a redirect to another host.
• SENSITIVE_HEADERS is kept as the exact-match base set.

The pattern is name-based only. A credential carried in a header whose name has none of those markers (for example X-Custom: Bearer ...) is still not detected; values are not inspected.

Tests

Adds tests/test_redaction.py, stdlib unittest, no new dependencies. It works with python -m unittest discover -s tests and pytest.

Ran 4 tests ... OK

Coverage: credential headers detected, ordinary headers untouched, redact_header replaces only the value, and request_dump() output contains no secret value for custom token headers.