Redact Vercel preview bypass headers

README.md

@@ -63,9 +63,21 @@ For details about specific commands, use the `--help` flag.
 
 ### Environment variables
 
-| Environment variable | Description                                                                         | Required |
-| -------------------- | ----------------------------------------------------------------------------------- | -------- |
-| `CASEDEV_API_KEY`    | API key authentication. Use your case.dev API key (e.g., sk_case_your_api_key_here) | yes      |
+| Environment variable                         | Description                                                                                 | Required |
+| -------------------------------------------- | ------------------------------------------------------------------------------------------- | -------- |
+| `CASEDEV_API_KEY`                  | API key authentication. Use your case.dev API key (e.g., sk_case_your_api_key_here) | yes      |
+| `CASEDEV_BASE_URL`                 | Override the API base URL for the process                                           | no       |
+| `CASEDEV_CUSTOM_HEADERS`            | Newline-delimited `Name: value` headers added to every API request                  | no       |
+
+For example, trusted CI or hosting infrastructure can authenticate a protected
+Preview deployment without changing individual commands:
+
+```sh
+export CASEDEV_CUSTOM_HEADERS='x-vercel-protection-bypass: <automation-secret>'
+```
+
+Treat custom-header values as secrets. The CLI's debug logger redacts known
+sensitive headers, including Vercel's protection bypass header.
 
 ### Global flags
 

internal/debugmiddleware/debug_middleware.go

@@ -26,6 +26,7 @@ var sensitiveHeaders = []string{
 	"x-api-key",
 	"cookie",
 	"set-cookie",
+	"x-vercel-protection-bypass",
 }
 
 // RequestLogger is a middleware that logs HTTP requests and responses.

internal/debugmiddleware/debug_middleware_test.go

@@ -143,6 +143,26 @@ func TestDebugMiddleware(t *testing.T) {
 		require.Contains(t, logBuf.String(), customAPIKeyHeader+": "+redactedPlaceholder)
 	})
 
+	t.Run("RedactsVercelProtectionBypassByDefault", func(t *testing.T) {
+		t.Parallel()
+
+		middleware, logBuf := setup()
+		req := httptest.NewRequest("GET", "https://example.com", nil)
+		req.Header.Set("x-vercel-protection-bypass", secretToken)
+
+		middleware.Middleware()(req, func(req *http.Request) (*http.Response, error) {
+			require.Equal(t, secretToken, req.Header.Get("x-vercel-protection-bypass"))
+			return &http.Response{}, nil
+		})
+
+		require.NotContains(t, logBuf.String(), secretToken)
+		require.Contains(
+			t,
+			logBuf.String(),
+			"X-Vercel-Protection-Bypass: "+redactedPlaceholder,
+		)
+	})
+
 	t.Run("RedactsMultipleSensitiveHeaders", func(t *testing.T) {
 		t.Parallel()