fix: harden audited download and release paths

src/store/useDownloadStore.test.ts

@@ -1879,7 +1879,7 @@ describe('useDownloadStore', () => {
       referer: 'https://adult.example/watch/123',
       silent: false,
       filename: null,
-      headers: `Cookie: stale=${'x'.repeat(64 * 1024)}\nUser-Agent: Firefox Test`,
+      headers: `Cookie: stale=${'x'.repeat(64 * 1024)}\nCookie2: stale=1\nAuthorization: Bearer stale\nProxy-Authorization: Basic stale\nSet-Cookie: stale=1\nSet-Cookie2: stale=1\nUser-Agent: Firefox Test`,
       cookies: `oversized=${'x'.repeat(64 * 1024)}`,
       cookie_scopes: null,
       media: true,

src/store/useDownloadStore.ts

@@ -209,12 +209,21 @@ export class SystemProxyResolutionError extends Error {
 const isSystemProxyConfigurationError = (error: unknown): boolean =>
   error instanceof SystemProxyResolutionError;
 
-const stripCookieHeaders = (value: string | null | undefined): string =>
+const stripSensitiveMediaHeaders = (value: string | null | undefined): string =>
   (value || '')
     .split(/\r?\n/)
     .filter(line => {
       const separator = line.indexOf(':');
-      return separator < 0 || line.slice(0, separator).trim().toLowerCase() !== 'cookie';
+      if (separator < 0) return true;
+      const name = line.slice(0, separator).trim().toLowerCase();
+      return ![
+        'authorization',
+        'cookie',
+        'cookie2',
+        'proxy-authorization',
+        'set-cookie',
+        'set-cookie2'
+      ].includes(name);
     })
     .join('\n')
     .trim();
@@ -1035,7 +1044,7 @@ export const useDownloadStore = create<DownloadState>((set, get) => {
     // extension builds; ordinary captured downloads retain their cookies.
     const cookies = request.media === true ? null : request.cookies;
     const headers = request.media === true
-      ? stripCookieHeaders(request.headers) || null
+      ? stripSensitiveMediaHeaders(request.headers) || null
       : request.headers;
 
     get().openAddModalWithUrls(