Sensitive values bypass the denylist in header and cookie collection

[s1gr1d]

A cookie header that cannot be split into name=value pairs ends up verbatim in an attribute key, and headers listed in headersToSpanAttributes skip the denylist, so an authorization header is sent in the clear.

[linear-code]

JS-3592