headi: 23 HTTP Headers, 1 Binary, and Most 403 Pages Fall Over

headi replays a request with 23 different HTTP headers and diffs the response — flagging access-control bypasses, internal-IP leaks, and Host-header SSRF in seconds. A look at why this small Go tool keeps showing up in bug-bounty workflows.