security: sensitive headers (Authorization, Cookie, X-Api-Key) captured in plain text — add default redaction

[imsankalp]

Summary

The interceptor captures all request and response headers verbatim, including security-sensitive values like Authorization: Bearer <token>, Cookie: session=..., and X-Api-Key: .... These are stored in NetworkRequestStorage, emitted to JavaScript, and rendered in the floating monitor UI — visible to anyone viewing the screen or reading device logs.

Proposed solution

Default redact list

The following headers are masked as [redacted] by default:

Authorization
Cookie
Set-Cookie
X-Api-Key
X-Auth-Token
X-Access-Token
Proxy-Authorization

Configuration via NetworkMonitorProvider

<NetworkMonitorProvider
  redactHeaders={['Authorization', 'X-Api-Key']}        // override default list
  additionalRedactHeaders={['X-Custom-Secret']}          // extend default list
  revealRedactedHeaders={false}                           // disallow tap-to-reveal (default: true)
>

Native side — redact at capture time

Apply redaction inside NetworkToolsInterceptor so no sensitive value ever reaches the JS store or event emitter:

private fun captureHeaders(request: Request, redactList: Set<String>): Map<String, String> {
    return request.headers.toMap().mapValues { (key, value) ->
        if (redactList.any { it.equals(key, ignoreCase = true) }) "[redacted]" else value
    }
}

Detail view UX

• Redacted values shown as [redacted] in grey italic
• Tap to reveal in-memory only (never re-stored) when revealRedactedHeaders = true

Acceptance criteria

• Default redact list covers the 7 headers listed above
• Redaction applied at native capture time — sensitive values never stored
• Header names matched case-insensitively
• NetworkMonitorProvider accepts redactHeaders and additionalRedactHeaders props
• Detail view shows [redacted] with tap-to-reveal toggle
• TypeScript types updated for the new provider props
• Unit test: request with Authorization header → stored value is [redacted]
• Unit test: custom redactHeaders overrides defaults correctly
• README security section documents default redaction behaviour