v1.2.1

[1.2.1] — 2026-08-01

Added

Credential cookies

• Cookies get the same treatment as headers, because a session cookie is as
  much a credential as a bearer token
• session, sessionid, sid, connect.sid, jsessionid, phpsessid,
  csrf_token, access_token, refresh_token, jwt and similar are
  recognised, along with patterns for names ending in _token, _auth,
  _secret or _key
• A recognised cookie's value moves into the secret store: encrypted in vault
  mode, cleared on lock, revealed with the eye button, omitted from exports
• Ordinary cookies such as locale or theme keep their inline value
• The shield button marks any cookie the built-in list does not recognise