[agusumri]

Problem

redact_header() only matched five exact header names (authorization, cookie, proxy-authorization, set-cookie, x-api-key). Any other credential header passed with -H was written verbatim into the request field of the output, which is meant to be shareable evidence.

Before, with -H "X-Auth-Token: s3cr3t" -H "Cookie: c=1":

POST /index.php HTTP/1.1
Host: example.com
X-Auth-Token: s3cr3t          <- leaked
Cookie: <redacted>
X-Api-Key: <redacted>

After:

X-Auth-Token: <redacted>
Cookie: <redacted>
X-Api-Key: <redacted>

Change

• New SENSITIVE_HEADER_PATTERN matches credential-bearing name segments: auth, authorization, bearer, cookie, key, passwd, password, secret, session, token, plus apikey/accesskey. Segment boundaries keep ordinary headers such as X-Request-Id, X-Forwarded-For, and X-Keyboard-Layout untouched.
• New is_sensitive_header() is the single predicate, used by both redact_header() and the existing cross-origin redirect stripping in send_post(). A header worth hiding is also worth dropping when the scan follows a redirect to another host.
• SENSITIVE_HEADERS is kept as the exact-match base set.

The pattern is name-based only. A credential carried in a header whose name has none of those markers (for example X-Custom: Bearer ...) is still not detected; values are not inspected.

Tests

Adds tests/test_redaction.py, stdlib unittest, no new dependencies. It works with python -m unittest discover -s tests and pytest.

Ran 4 tests ... OK

Coverage: credential headers detected, ordinary headers untouched, redact_header replaces only the value, and request_dump() output contains no secret value for custom token headers.

[auditbenchai]

No actionable comments were generated in this review. 🎉

Merge risk: ⚪ Minimal · up to 14f8edb

The change strictly widens header redaction and redirect stripping using bounded keyword patterns, with negligible risk of breaking core scanning functionality.

Merge readiness: 🟡 Ready to merge, with notes

Pre-merge checks: ✅ 9 · ⚠️ 1

⚠️ Checks to review: 1 warning

Check name	Status	Explanation	Resolution
CI checks	⚠️	No CI checks ran on this commit.	Add CI so every PR is built and tested.

✅ Passed checks: 9 passed

Check name	Status	Explanation
Merge conflicts	✅	Merges cleanly into master.
Secrets	✅	No keys, passwords or tokens in the changed code.
Blocking issues	✅	No critical or high-severity issues in the changed lines.
Tests	✅	Tests were changed alongside the code.
PR size	✅	87 lines changed.
Title check	✅	The title clearly summarizes the purpose of redacting credential-bearing headers in the scan output.
Description check	✅	The description clearly explains the problem, the regex approach taken, and the unit tests run.
Linked issues check	✅	No issue links or references were specified in the description.
Out of scope changes check	✅	All changes directly pertain to identifying sensitive headers and testing their redaction.

📝 Walkthrough

This pull request expands sensitive HTTP header detection by adding a regex pattern to identify credential-bearing headers beyond the five hardcoded defaults. The new is_sensitive_header() helper is used both for redacting values in scan output dumps and for stripping sensitive headers during cross-origin redirects. Unit tests are also added to verify header redaction behavior and ensure common headers remain untouched.

File	Changes
scanner.py	Adds regex matching for sensitive header names and uses it in redaction and redirect header stripping.
tests/test_redaction.py	Adds unit tests covering sensitive header detection, redaction, and request dumping.

ℹ️ Review info

• Commit: 14f8edb
• Verdict: ✅ Pass
• Findings: none
• Review: local checks plus AI review of the changed lines
• Scope: Reviewed 2/2 files (of 2 total) — 0 from cache, 0 needed no AI review. Found 0 finding(s), 0 potential secret(s).

💬 Reply to any inline comment and Audit Bench Ai will recheck that code and answer in the thread. Mention @auditbench in the conversation to ask about the whole PR.

🛠️ Open the full report and fix with AI

Thanks for using Audit Bench Ai! Free pull request reviews for open source: paste any public PR at auditbenchai.com/scan.

_{Reviewed by Audit Bench Ai · AI code review for security, logic and performance · Review any public PR free}