pub(crate) fn is_credential_like_key(key: &str) -> bool {
let normalized = key.to_ascii_lowercase().replace('-', "_");
matches!(
normalized.as_str(),
"authorization"
| "bearer"
| "credential"
| "credentials"
| "aws_secret_access_key"
| "aws_session_token"
| "session_token"
| "secret_key"
| "api_key"
| "apikey"
| "password"
| "passwd"
| "secret"
| "token"
| "access_token"
| "accesstoken"
| "refresh_token"
| "refreshtoken"
| "auth_token"
| "authtoken"
| "id_token"
| "idtoken"
| "client_secret"
| "clientsecret"
| "account_id"
| "accountid"
| "chatgpt_account_id"
) || normalized.ends_with("_api_key")
|| normalized.ends_with("_secret")
|| normalized.ends_with("_secret_access_key")
|| normalized.ends_with("_session_token")
|| normalized.ends_with("_secret_key")
|| normalized.ends_with("_token")
|| normalized.ends_with("_credential")
|| normalized.ends_with("_credentials")
}