{"version":"2.1.251","anchor":"wider-pattern-for-spotting-sensitive-http-headers","canonical_anchor":"wider-pattern-for-spotting-sensitive-http-headers","heading":"Wider pattern for spotting sensitive HTTP headers","tier":"notice","area":"Privacy","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/wider-pattern-for-spotting-sensitive-http-headers","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### Wider pattern for spotting sensitive HTTP headers\n\nMore HTTP headers are recognised as sensitive, including cloud provider auth headers.\n\n**What**\n\nA pattern was added that recognises headers containing auth, key, token, cookie, secret or credential, plus cloud provider prefixes including Google, AWS, Azure and Cloudflare Access ones, for treating those headers as sensitive.\n\n**Details**\n\n- Where it is applied is not visible from the pattern itself.\n\n**Evidence**\n\n`x-goog-|l5d-|bypass|guardrail|amz|x-ms-|azureml`\n\n- Area: Privacy\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}