The added entry "proxy-authorization" uses a hyphen, but other multi-word entries in DEFAULT_DENYLIST (e.g., x_api_key, x_csrftoken, x_forwarded_for, set_cookie) use underscores. Scrubbing matches keys via k.lower() in self.denylist (scrubber.py:116), so if request headers are normalized to underscore form (e.g., proxy_authorization) before scrubbing — as is common in WSGI environments — this entry will not match and the Proxy-Authorization header value could leak through unscrubbed.