HeaderVault

No. It only gives the browser a list of header rules built from your profiles, and the browser applies them. HeaderVault never reads requests, responses, cookies or page content, and has no analytics.

Browsers only allow header changes on sites you have approved. When you add a site to a profile you grant access to that site only. You can revoke it any time in your browser's extension settings.

In your browser's local extension storage on your device. Nothing is uploaded. Header values such as tokens stay on your machine, so export files you share with a team should not contain secrets.

Check that the profile is on, the scope matches the URL (use the Test URL box), the site permission is granted, and that the browser allows modifying that header. Browsers block a few headers, such as Host and Content-Length.