What
A pattern was added that recognises headers containing auth, key, token, cookie, secret or credential, plus cloud provider prefixes including Google, AWS, Azure and Cloudflare Access ones, for treating those headers as sensitive.
Details
- Where it is applied is not visible from the pattern itself.
Evidence
x-goog-|l5d-|bypass|guardrail|amz|x-ms-|azureml
Strings lifted out of the shipped bundle, so the claim above can be checked against them.