context

network telemetry published each request's body (post_data) and every request and response header as CDP reported them. that's the same view as the DevTools Network panel, which assumes the person reading it is the person using the browser. telemetry is read elsewhere (stored events, SSE, OTLP export), so it should default to what's safe to share.

this applies sanitization to network telemetry, starting with Chrome's sanitized HAR export defaults (Chrome 130+), which leave out Cookie, Set-Cookie and Authorization. request bodies can hold form input, including passwords, so they're left out for now and come back once a redaction layer can remove sensitive fields before events are published.

changes

• network_request no longer includes post_data, and the pending request state no longer holds it.
• request and response headers leave out Authorization, Proxy-Authorization, Cookie and Set-Cookie, matching any capitalization.
• post_data stays in the schema as an optional field so existing clients keep decoding events. the openapi descriptions, regenerated oapi.go and the cdpmonitor README describe what's left out.
• response bodies are unchanged.

#462 adds headers from requestWillBeSentExtraInfo / responseReceivedExtraInfo and a request_headers field on responses. those should go through publishedHeaders as well; whichever PR merges second needs a rebase.

testing

• new unit test TestNetworkEvents/credentials_left_out sends canary values in the body and each credential header and checks none are published.
• KERNEL_CDPMONITOR_CHROME_E2E=1 go test ./lib/cdpmonitor/ against real Chromium. the frames and workers capture tests now assert post_data is absent.
• go test -race $(go list ./... | grep -v /e2e$)
• not run: the image e2e suite (make test).