Under the hood
Useful2 Signal3
The HTTP layer now knows which header names count as secrets for masking.
What's wrong with this entry?
Anonymous. No account, no email.
What
The first-party HTTP module gained a set of header names to treat as sensitive: authorization, proxy-authorization, x-authorization, x-api-key and cookie. It sits beside the trusted-origin list and the request wrappers, so it is part of the shared request path.
Evidence
"proxy-authorization"
Strings lifted out of the shipped bundle, so the claim above can be checked against them.