Add passive security review and credential-header comparisons #4

User problem

Security testers need captured evidence about browser-facing security policies and a controlled way to compare authenticated and anonymous access.

Acceptance criteria

• Review captured transport, security headers/CSP/framing, CORS, cookies, cache policy, URL credential fields and detailed error responses.
• Deduplicate observations and include evidence, context and remediation guidance without calling them confirmed vulnerabilities.
• Hide known query credentials and cookie values in exported observation evidence.
• Persist reviewed/ignored states and export reports.
• Compare GET/HEAD/OPTIONS responses with and without credential headers, to one origin with redirects disabled.
• Show that comparison sends two requests and strips only headers; support stop and response diff.
• Keep passive review free of network sends.

Implementation status

Implemented and verified in PR #1 on feat/v1.1-workbench. PR #1 was merged into main on 2026-10-03, merge commit eeb65009fa6e343cf6dd1f67386be0afc5bbb3e5. GitHub automatically closed this issue as completed through the PR's closing reference. The source changes are now on main; the Chrome Web Store release remains pending.

Verification

Node tests cover finding generation/deduplication/redaction and credential stripping. Brave integration verifies comparison headers and temporary-rule cleanup.

Relevant source

lab.js, lab-ui.js, dashboard.html, tests/lab.test.js

Related v1.1 work is tracked through PR #1. Follow-up improvements or bugs should use their own issue and PR.

Completion record

The implementation commits are 7b76001, 3ee1668, 4f1d89c, 504051e, and test follow-up 619736d. Relevant verification is described above and in PR #1. All 29 Node regressions and JavaScript syntax checks pass; GitHub CI passes on Node 22. The workbench/browser features were checked with isolated local HTTP/WebSocket fixtures; shortcut labels were also checked for Mac/Windows/Linux platforms. The maintainer merged PR #1, and GitHub closed this issue automatically; new bugs or follow-up scope should use a separate issue, or reopen this one if its original criteria fail.