Maybe scrub cookies and authorization headers by default, but make them an opt-in for bugs where they're relevant?
Edit: it looks like this is already the case!
Edit: it looks like this is already the case!
The tool seems to be built for people who don't know what to include in a proper bug report (As they are maybe not technical enough), so not sure how helpful that choice would be for them.