Function is_sensitive_header 

pub fn is_sensitive_header(name: &str) -> bool

Returns true when a header named name likely carries a credential, so its value must not be logged.

Matches, ignoring case, the exact credential list (is_credential_header), set-cookie, and any name containing key, token, secret or auth. Erring towards redaction is deliberate: a rate-limit header hidden from a debug log costs less than a leaked key. This rule only redacts: a plain header it matches but the exact list does not, such as Idempotency-Key, is still sent.

use allama_http::is_sensitive_header;

assert!(is_sensitive_header("Authorization"));
assert!(is_sensitive_header("x-my-gateway-token"));
assert!(!is_sensitive_header("x-request-id"));