I see in the Security page [0] that you filter out headers that you think are PII or tokens. And I see that you're willing to receive feedback via email. I don't think this approach is scalable, for the main reason that sometimes we use custom headers to pass tokens.

My suggestion is to have a setting that lists default headers you think should be obfuscated, and the user/team can remove and add to them as they like.

0. https://jam.dev/docs/product-features/dev-tools/security