diff --git a/.changeset/drift-deepobject-query-params.md b/.changeset/drift-deepobject-query-params.md
new file mode 100644
index 0000000000..e76a699399
--- /dev/null
+++ b/.changeset/drift-deepobject-query-params.md
@@ -0,0 +1,6 @@
+---
+'@redocly/cli': patch
+---
+
+Fixed the `drift` command's `schema-consistency` rule reporting false-positive "Undocumented query parameter" findings for `deepObject`-style query parameters.
+Traffic keys like `namespace[id]=...&namespace[name]=...` are now matched to the documented `namespace` parameter, and the reconstructed object is validated against the parameter schema.
diff --git a/.changeset/drift-ignore-headers.md b/.changeset/drift-ignore-headers.md
new file mode 100644
index 0000000000..c60f1e9dd5
--- /dev/null
+++ b/.changeset/drift-ignore-headers.md
@@ -0,0 +1,7 @@
+---
+'@redocly/cli': minor
+---
+
+Added an `--ignore-headers` option to the experimental `drift` and `proxy` commands.
+It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing `*` matches by prefix (for example `x-consumer-*`).
+Use it to silence headers a gateway or proxy adds that are not part of the API contract.
diff --git a/.changeset/drift-skip-request-checks-on-4xx.md b/.changeset/drift-skip-request-checks-on-4xx.md
new file mode 100644
index 0000000000..5e8ad60549
--- /dev/null
+++ b/.changeset/drift-skip-request-checks-on-4xx.md
@@ -0,0 +1,9 @@
+---
+'@redocly/cli': patch
+---
+
+Fixed an issue where the `drift` command's `schema-consistency` rule reported false-positive request findings for exchanges the server rejected with a `4xx` client error.
+For example: missing required parameter, missing required body, request-body schema mismatch.
+A `4xx` response means the server never accepted the request.
+Validating it against the operation's success-path contract flagged the server's own correct rejection as drift.
+Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.
diff --git a/.changeset/loopback-drift-transport.md b/.changeset/loopback-drift-transport.md
new file mode 100644
index 0000000000..c767f280f4
--- /dev/null
+++ b/.changeset/loopback-drift-transport.md
@@ -0,0 +1,6 @@
+---
+'@redocly/cli': patch
+---
+
+Fixed an issue where the `drift` command's `security-baseline` rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: `localhost`, `*.localhost`, `127.0.0.0/8`, `[::1]`.
+Sandboxed recordings no longer produce transport warnings.
diff --git a/docs/@v2/commands/drift.md b/docs/@v2/commands/drift.md
index ea030f9953..36e0f3a9f4 100644
--- a/docs/@v2/commands/drift.md
+++ b/docs/@v2/commands/drift.md
@@ -55,6 +55,7 @@ redocly drift <traffic> --api <api> [--match-mode=<option>]
 | --match-mode     | string  | How requests are located via the description `servers`. `strict-host` also requires the host to match; `basepath` matches only the base path.<br/>**Possible values:** `strict-host`, `basepath`. Default value is `strict-host`. Mutually exclusive with `--server`.             |
 | --server         | string  | Server URL the traffic was captured against (host, host + base path, or a path-only prefix like `/api`). Only requests under it are considered, and the rest of their URL is treated as the API path. Replaces the description `servers`. Mutually exclusive with `--match-mode`. |
 | --ignore-cookies | boolean | Ignore cookie-based checks (useful for logs exported without cookies). Default value is `false`.                                                                                                                                                                                  |
+| --ignore-headers | string  | Comma-separated header names to skip in undocumented-header checks. A trailing `*` matches by prefix, for example `x-consumer-*`. Useful for headers a gateway or proxy adds that are not part of the API contract.                                                               |
 | --max-findings   | number  | Maximum findings shown in pretty output. Default value is `10`.                                                                                                                                                                                                                   |
 | --min-severity   | string  | Discard findings below this severity from the report (all formats).<br/>**Possible values:** `info`, `warning`, `error`. Default value is `info`.                                                                                                                                 |
 | --rules          | string  | Comma-separated subset of builtin rules to run: `undocumented-endpoint`, `schema-consistency`, `security-baseline`, `owasp-api-top10`.                                                                                                                                            |
@@ -89,6 +90,16 @@ Only requests under it are considered, and the remaining path is matched against
 redocly drift ./traffic.har --api ./openapi.yaml --server localhost:9000
 ```
 
+### Ignore headers added by a gateway or proxy
+
+A gateway such as Caddy often injects headers that are not part of the API contract (for example authentication or consumer-identity headers).
+Skip them so they don't show up as undocumented headers.
+Use a trailing `*` to match a family of headers by prefix:
+
+```bash
+redocly drift ./traffic.har --api ./openapi.yaml --ignore-headers "x-caddy-auth-token,x-auth-intent,x-consumer-*"
+```
+
 ### Write the report to a file
 
 ```bash
diff --git a/docs/@v2/commands/proxy.md b/docs/@v2/commands/proxy.md
index 8259b6b082..0811f18c72 100644
--- a/docs/@v2/commands/proxy.md
+++ b/docs/@v2/commands/proxy.md
@@ -45,6 +45,7 @@ redocly proxy --target <url> --har <path> [--port=<number>] [--host=<string>]
 | --format         | string  | Output format for the validation report printed on shutdown.<br/>**Possible values:** `pretty`, `json`, `csv`, `sarif`. Default value is `pretty`. |
 | --match-mode     | string  | Endpoint matching mode.<br/>**Possible values:** `strict-host`, `basepath`. Default value is `strict-host`.                                        |
 | --ignore-cookies | boolean | Ignore cookie-based checks. Default value is `false`.                                                                                              |
+| --ignore-headers | string  | Comma-separated header names to skip in undocumented-header checks. A trailing `*` matches by prefix, for example `x-consumer-*`.                  |
 | --max-findings   | number  | Maximum findings shown in pretty output. Default value is `10`.                                                                                    |
 | --rules          | string  | Comma-separated subset of built-in rules to run: `undocumented-endpoint`, `schema-consistency`, `security-baseline`, `owasp-api-top10`.            |
 | --config         | string  | Specify the path to the [configuration file](../configuration/index.md).                                                                           |
diff --git a/packages/cli/src/__tests__/commands/drift/schema-rule.test.ts b/packages/cli/src/__tests__/commands/drift/schema-rule.test.ts
new file mode 100644
index 0000000000..436b268aed
--- /dev/null
+++ b/packages/cli/src/__tests__/commands/drift/schema-rule.test.ts
@@ -0,0 +1,158 @@
+import { SchemaConsistencyRule } from '../../../commands/drift/rules/builtins/schema.js';
+import type {
+  MatchedOperation,
+  NormalizedExchange,
+  OpenApiParameter,
+  RuleContext,
+} from '../../../commands/drift/types/index.js';
+import { parseHeaderIgnoreList } from '../../../commands/drift/utils/http.js';
+
+function createMatchedOperation(requestParameters?: OpenApiParameter[]): MatchedOperation {
+  return {
+    operation: {
+      operationId: 'listOrderItems',
+      method: 'get',
+      pathTemplate: '/order-items',
+      pathRegex: /^\/order-items$/,
+      pathParams: [],
+      pathScore: 1,
+      servers: [],
+      requestParameters: requestParameters ?? [{ name: 'filter', in: 'query', required: true }],
+      requestBodyContent: {},
+      requestBodyRequired: false,
+      responseBodyContent: {},
+      security: undefined,
+      securitySchemes: {},
+      specSource: 'openapi.yaml',
+    },
+    pathParams: {},
+  };
+}
+
+function createContext(
+  responseStatus: number,
+  options: {
+    requestHeaders?: Record<string, string>;
+    ignoreHeaders?: string[];
+    queryString?: string;
+    requestParameters?: OpenApiParameter[];
+  } = {}
+): RuleContext {
+  const requestUrl = `https://api.example.com/order-items${
+    options.queryString ? `?${options.queryString}` : ''
+  }`;
+  const parsedUrl = new URL(requestUrl);
+  const exchange: NormalizedExchange = {
+    index: 0,
+    source: 'test',
+    request: {
+      method: 'GET',
+      url: requestUrl,
+      path: parsedUrl.pathname,
+      query: parsedUrl.searchParams,
+      protocol: parsedUrl.protocol,
+      protocolKnown: true,
+      host: parsedUrl.host,
+      headers: options.requestHeaders ?? {},
+    },
+    response: {
+      status: responseStatus,
+      headers: {},
+    },
+  };
+
+  return {
+    exchange,
+    matchedOperation: createMatchedOperation(options.requestParameters),
+    matchMode: 'strict-host',
+    hostCompatibleWithSpecServers: true,
+    ignoreHeaders: options.ignoreHeaders ? parseHeaderIgnoreList(options.ignoreHeaders) : undefined,
+    validateSchema: () => ({ valid: true, errors: [] }),
+  };
+}
+
+describe('schema-consistency required parameter check', () => {
+  const rule = new SchemaConsistencyRule();
+
+  function missingFilterFindings(context: RuleContext) {
+    return rule
+      .analyze(context)
+      .filter((finding) => finding.message === 'Missing required query parameter: "filter"');
+  }
+
+  it('flags a missing required query parameter when the server accepted the request', () => {
+    expect(missingFilterFindings(createContext(200))).toHaveLength(1);
+  });
+
+  it('does not flag a missing required query parameter when the server rejected the request with 4xx', () => {
+    expect(missingFilterFindings(createContext(400))).toHaveLength(0);
+  });
+});
+
+describe('schema-consistency undocumented header check', () => {
+  const rule = new SchemaConsistencyRule();
+
+  function undocumentedHeaderFindings(context: RuleContext) {
+    return rule
+      .analyze(context)
+      .filter((finding) => finding.message.startsWith('Undocumented header in traffic:'));
+  }
+
+  it('flags an undocumented header that is not in the ignore list', () => {
+    const context = createContext(200, { requestHeaders: { 'x-caddy-auth-token': 'secret' } });
+    expect(undocumentedHeaderFindings(context)).toHaveLength(1);
+  });
+
+  it('still flags undocumented headers when the server rejected the request with 4xx', () => {
+    const context = createContext(400, { requestHeaders: { 'x-caddy-auth-token': 'secret' } });
+    expect(undocumentedHeaderFindings(context)).toHaveLength(1);
+  });
+
+  it('skips headers matched by an exact name or a prefix pattern in --ignore-headers', () => {
+    const context = createContext(200, {
+      requestHeaders: {
+        'x-caddy-auth-token': 'secret',
+        'x-consumer-id': '42',
+        'x-consumer-teams': 'core',
+      },
+      ignoreHeaders: ['x-caddy-auth-token', 'x-consumer-*'],
+    });
+    expect(undocumentedHeaderFindings(context)).toHaveLength(0);
+  });
+});
+
+describe('schema-consistency deepObject query parameter check', () => {
+  const rule = new SchemaConsistencyRule();
+
+  it('maps bracketed query keys to a documented deepObject parameter and validates the object', () => {
+    const validatedValues: unknown[] = [];
+    const context = createContext(200, {
+      queryString: 'namespace[id]=acme&namespace[name]=acme&other[id]=1',
+      requestParameters: [
+        {
+          name: 'namespace',
+          in: 'query',
+          required: true,
+          style: 'deepObject',
+          schema: { type: 'object' },
+        },
+      ],
+    });
+    context.validateSchema = (_schema, value) => {
+      validatedValues.push(value);
+      return { valid: true, errors: [] };
+    };
+
+    const findings = rule.analyze(context);
+
+    expect(
+      findings
+        .filter((finding) => finding.message.startsWith('Undocumented query parameter'))
+        .map((finding) => finding.message)
+    ).toEqual(['Undocumented query parameter in traffic: "other[id]"']);
+    expect(
+      findings.filter((finding) => finding.message.startsWith('Missing required query parameter'))
+    ).toHaveLength(0);
+    expect(validatedValues).toEqual([{ id: 'acme', name: 'acme' }]);
+  });
+});
diff --git a/packages/cli/src/__tests__/commands/drift/security-rule.test.ts b/packages/cli/src/__tests__/commands/drift/security-rule.test.ts
new file mode 100644
index 0000000000..db56ccee99
--- /dev/null
+++ b/packages/cli/src/__tests__/commands/drift/security-rule.test.ts
@@ -0,0 +1,137 @@
+import { SecurityRule } from '../../../commands/drift/rules/builtins/security.js';
+import type {
+  MatchedOperation,
+  NormalizedExchange,
+  RuleContext,
+} from '../../../commands/drift/types/index.js';
+
+function createMatchedOperation(): MatchedOperation {
+  return {
+    operation: {
+      operationId: 'listMenuItems',
+      method: 'get',
+      pathTemplate: '/menu',
+      pathRegex: /^\/menu$/,
+      pathParams: [],
+      pathScore: 1,
+      servers: [],
+      requestParameters: [],
+      requestBodyContent: {},
+      requestBodyRequired: false,
+      responseBodyContent: {},
+      security: undefined,
+      securitySchemes: {},
+      specSource: 'openapi.yaml',
+    },
+    pathParams: {},
+  };
+}
+
+function createContext(
+  requestUrl: string,
+  options?: {
+    headers?: Record<string, string>;
+    protocolKnown?: boolean;
+  }
+): RuleContext {
+  const parsedUrl = new URL(requestUrl);
+  const exchange: NormalizedExchange = {
+    index: 0,
+    source: 'test',
+    request: {
+      method: 'GET',
+      url: requestUrl,
+      path: parsedUrl.pathname,
+      query: parsedUrl.searchParams,
+      protocol: parsedUrl.protocol,
+      protocolKnown: options?.protocolKnown ?? true,
+      host: parsedUrl.host,
+      headers: options?.headers ?? {},
+    },
+    response: {
+      status: 200,
+      headers: {},
+    },
+  };
+
+  return {
+    exchange,
+    matchedOperation: createMatchedOperation(),
+    matchMode: 'strict-host',
+    hostCompatibleWithSpecServers: true,
+    validateSchema: () => ({ valid: true, errors: [] }),
+  };
+}
+
+describe('security-baseline insecure transport check', () => {
+  const rule = new SecurityRule();
+  const authHeaders = { authorization: 'Bearer test-token' };
+
+  function transportFindings(context: RuleContext) {
+    return rule
+      .analyze(context)
+      .filter(
+        (finding) =>
+          finding.message === 'Potential credential exposure over insecure HTTP transport'
+      );
+  }
+
+  it('flags authenticated requests over plain HTTP to a public host', () => {
+    const findings = transportFindings(
+      createContext('http://api.example.com/menu', { headers: authHeaders })
+    );
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toMatchObject({
+      ruleId: 'security-baseline',
+      severity: 'warning',
+      details: { hasAuthorizationHeader: true },
+    });
+  });
+
+  it('flags sensitive query parameters over plain HTTP to a public host', () => {
+    const findings = transportFindings(createContext('http://api.example.com/menu?api_key=12345'));
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0].details).toMatchObject({
+      sensitiveQueryKeys: ['api_key'],
+    });
+  });
+
+  it.each([
+    'http://localhost:9000/menu',
+    'http://sub.localhost:9000/menu',
+    'http://127.0.0.1:4040/menu',
+    'http://127.1.2.3/menu',
+    'http://[::1]:8080/menu',
+  ])('does not flag authenticated plain-HTTP requests to loopback host %s', (url) => {
+    expect(transportFindings(createContext(url, { headers: authHeaders }))).toHaveLength(0);
+  });
+
+  it('does not flag sensitive query parameters sent to a loopback host', () => {
+    expect(transportFindings(createContext('http://localhost:9000/menu?token=abc'))).toHaveLength(
+      0
+    );
+  });
+
+  it('does not flag unauthenticated plain-HTTP requests', () => {
+    expect(transportFindings(createContext('http://api.example.com/menu'))).toHaveLength(0);
+  });
+
+  it('does not flag authenticated HTTPS requests', () => {
+    expect(
+      transportFindings(createContext('https://api.example.com/menu', { headers: authHeaders }))
+    ).toHaveLength(0);
+  });
+
+  it('does not flag when the capture did not record the scheme', () => {
+    expect(
+      transportFindings(
+        createContext('http://api.example.com/menu', {
+          headers: authHeaders,
+          protocolKnown: false,
+        })
+      )
+    ).toHaveLength(0);
+  });
+});
diff --git a/packages/cli/src/commands/drift/README.md b/packages/cli/src/commands/drift/README.md
index b86972976e..e0ea9a68d7 100644
--- a/packages/cli/src/commands/drift/README.md
+++ b/packages/cli/src/commands/drift/README.md
@@ -61,3 +61,8 @@ redocly drift ./traffic.har --api ./openapi.yaml --format json -o ./drift-report
 - JSON-array traffic files (HAR/Kong/webserver-json) are read fully into memory.
   For very large captures, prefer the NDJSON format.
 - Builtin `owasp-api-top10` is opt-in via `--rules owasp-api-top10`.
+- Builtin `security-baseline` does not report insecure-transport findings for loopback hosts (`localhost`, `*.localhost`, `127.0.0.0/8`, `[::1]`).
+  Sandboxed captures, for example, recorded with `redocly proxy` against a local target during e2e runs, stay warning-free.
+- Builtin `schema-consistency` skips request-side checks (required parameters, required body, request-body schema) when the response is a `4xx` client error.
+  The server rejected the request, so validating it against the operation's success-path contract would report the server's own correct rejection as drift.
+- Builtin `schema-consistency` understands `deepObject`-style query parameters: traffic keys like `name[property]=value` are matched to the documented parameter and validated against its object schema instead of being reported as undocumented.
diff --git a/packages/cli/src/commands/drift/engine/runner.ts b/packages/cli/src/commands/drift/engine/runner.ts
index d1f54505d1..e71574738c 100644
--- a/packages/cli/src/commands/drift/engine/runner.ts
+++ b/packages/cli/src/commands/drift/engine/runner.ts
@@ -21,6 +21,7 @@ export async function runTrafficValidation(options: RunnerOptions): Promise<Runn
     openApiIndex: options.openApiIndex,
     matchMode: options.matchMode,
     ignoreCookies: options.ignoreCookies,
+    ignoreHeaders: options.ignoreHeaders,
     previewFindingsLimit: options.previewFindingsLimit,
     activeRules: options.activeRules,
     server: options.server,
diff --git a/packages/cli/src/commands/drift/engine/validation-session.ts b/packages/cli/src/commands/drift/engine/validation-session.ts
index 2b23b7004f..20dc9fddce 100644
--- a/packages/cli/src/commands/drift/engine/validation-session.ts
+++ b/packages/cli/src/commands/drift/engine/validation-session.ts
@@ -16,6 +16,7 @@ import type {
   RunSummary,
 } from '../types/index.js';
 import { createProblemKey } from '../utils/finding-groups.js';
+import { parseHeaderIgnoreList, type HeaderIgnoreList } from '../utils/http.js';
 import { normalizeServerPrefix, resolvePathForServer } from '../utils/server.js';
 import { SchemaValidator } from './schema-validator.js';
 
@@ -170,6 +171,8 @@ export interface ValidationSessionOptions {
   openApiIndex: OpenApiIndex;
   matchMode: MatchMode;
   ignoreCookies?: boolean;
+  /** Header names/prefixes (e.g. `x-consumer-*`) to skip in undocumented-header checks. */
+  ignoreHeaders?: string[];
   previewFindingsLimit?: number;
   activeRules?: string[];
   /**
@@ -208,6 +211,7 @@ export class ValidationSession {
   private totalProblemGroups = 0;
 
   private readonly server: string | undefined;
+  private readonly ignoreHeaders: HeaderIgnoreList | undefined;
   private readonly minSeverityRank: number;
   private readonly specServerHosts: Set<string>;
   private readonly hasHostlessSpecServer: boolean;
@@ -216,6 +220,9 @@ export class ValidationSession {
     this.options = options;
     this.rules = rules;
     this.server = normalizeServerPrefix(options.server);
+    this.ignoreHeaders = options.ignoreHeaders
+      ? parseHeaderIgnoreList(options.ignoreHeaders)
+      : undefined;
     const { specServerHosts, hasHostlessSpecServer } = collectSpecServerHosts(options.openApiIndex);
     this.specServerHosts = specServerHosts;
     this.hasHostlessSpecServer = hasHostlessSpecServer;
@@ -273,6 +280,7 @@ export class ValidationSession {
       matchMode: this.options.matchMode,
       hostCompatibleWithSpecServers: relativePathOverride !== undefined || hostCompatible,
       ignoreCookies: this.options.ignoreCookies ?? false,
+      ignoreHeaders: this.ignoreHeaders,
       validateSchema: (schema, value, options) =>
         options?.coerce
           ? this.coercingSchemaValidator.validate(schema, value, options?.target)
diff --git a/packages/cli/src/commands/drift/index.ts b/packages/cli/src/commands/drift/index.ts
index e3671245cb..31a8012e45 100644
--- a/packages/cli/src/commands/drift/index.ts
+++ b/packages/cli/src/commands/drift/index.ts
@@ -25,6 +25,7 @@ export type DriftArgv = {
   'report-format': ReportFormat;
   'match-mode'?: MatchMode;
   'ignore-cookies'?: boolean;
+  'ignore-headers'?: string;
   'max-findings': number;
   rules?: string;
   output?: string;
@@ -88,6 +89,7 @@ export async function handleDrift({ argv, config }: CommandArgs<DriftArgv>) {
   const trafficPath = normalizeFsPath(argv.traffic);
   const trafficFormat = argv['traffic-format'];
   const activeRules = argv.rules ? parseCsv(argv.rules) : undefined;
+  const ignoreHeaders = argv['ignore-headers'] ? parseCsv(argv['ignore-headers']) : undefined;
 
   const server = argv.server;
   if (server && argv['match-mode']) {
@@ -108,6 +110,7 @@ export async function handleDrift({ argv, config }: CommandArgs<DriftArgv>) {
     format: trafficFormat,
     matchMode,
     ignoreCookies: argv['ignore-cookies'],
+    ignoreHeaders,
     previewFindingsLimit: argv['max-findings'],
     activeRules,
     openApiIndex,
diff --git a/packages/cli/src/commands/drift/openapi/loader.ts b/packages/cli/src/commands/drift/openapi/loader.ts
index b574ba899f..d0d463855d 100644
--- a/packages/cli/src/commands/drift/openapi/loader.ts
+++ b/packages/cli/src/commands/drift/openapi/loader.ts
@@ -82,6 +82,7 @@ function normalizeParameters(parameters: unknown): OpenApiParameter[] {
       name: String(entry.name ?? ''),
       in: location,
       required: Boolean(entry.required) || location === 'path',
+      style: typeof entry.style === 'string' ? entry.style : undefined,
       schema: entry.schema,
     });
   }
diff --git a/packages/cli/src/commands/drift/rules/builtins/schema.ts b/packages/cli/src/commands/drift/rules/builtins/schema.ts
index 14fe5624e7..59776a6233 100644
--- a/packages/cli/src/commands/drift/rules/builtins/schema.ts
+++ b/packages/cli/src/commands/drift/rules/builtins/schema.ts
@@ -265,6 +265,32 @@ function validateParameter(
   }
 }
 
+// deepObject-style query parameters serialize object properties as "name[property]=value".
+const DEEP_OBJECT_QUERY_KEY_REGEX = /^([^[\]]+)\[([^[\]]+)\]$/;
+
+function parseDeepObjectQueryKey(
+  key: string
+): { parameterName: string; property: string } | undefined {
+  const keyMatch = key.match(DEEP_OBJECT_QUERY_KEY_REGEX);
+  return keyMatch ? { parameterName: keyMatch[1], property: keyMatch[2] } : undefined;
+}
+
+function getDeepObjectParameterValue(
+  parameterName: string,
+  query: URLSearchParams
+): Record<string, string> | undefined {
+  let objectValue: Record<string, string> | undefined;
+  for (const [key, value] of query) {
+    const deepObjectKey = parseDeepObjectQueryKey(key);
+    if (deepObjectKey?.parameterName === parameterName) {
+      objectValue ??= {};
+      objectValue[deepObjectKey.property] = value;
+    }
+  }
+
+  return objectValue;
+}
+
 function getActualParameterValue(
   parameter: OpenApiParameter,
   context: RuleContext,
@@ -274,6 +300,9 @@ function getActualParameterValue(
     case 'path':
       return context.matchedOperation?.pathParams[parameter.name];
     case 'query': {
+      if (parameter.style === 'deepObject') {
+        return getDeepObjectParameterValue(parameter.name, context.exchange.request.query);
+      }
       const values = context.exchange.request.query.getAll(parameter.name);
       if (values.length === 0) {
         return undefined;
@@ -303,32 +332,43 @@ function createUndocumentedParameterFindings(
     header: new Set<string>(),
     cookie: new Set<string>(),
   };
+  const deepObjectQueryParams = new Set<string>();
 
   for (const parameter of matchedOperation.operation.requestParameters) {
     if (parameter.in === 'header') {
       paramsByLocation.header.add(parameter.name.toLowerCase());
     } else if (parameter.in === 'query' || parameter.in === 'cookie') {
       paramsByLocation[parameter.in].add(parameter.name);
+      if (parameter.in === 'query' && parameter.style === 'deepObject') {
+        deepObjectQueryParams.add(parameter.name);
+      }
     }
   }
 
   for (const name of new Set(context.exchange.request.query.keys())) {
-    if (!paramsByLocation.query.has(name)) {
-      findings.push({
-        ruleId: 'schema-consistency',
-        severity: 'warning',
-        category: 'documentation',
-        message: `Undocumented query parameter in traffic: "${name}"`,
-        exchangeIndex: context.exchange.index,
-        operationId: matchedOperation.operation.operationId,
-        specSource: matchedOperation.operation.specSource,
-        target: 'request',
-      });
+    if (paramsByLocation.query.has(name)) {
+      continue;
+    }
+
+    const deepObjectKey = parseDeepObjectQueryKey(name);
+    if (deepObjectKey && deepObjectQueryParams.has(deepObjectKey.parameterName)) {
+      continue;
     }
+
+    findings.push({
+      ruleId: 'schema-consistency',
+      severity: 'warning',
+      category: 'documentation',
+      message: `Undocumented query parameter in traffic: "${name}"`,
+      exchangeIndex: context.exchange.index,
+      operationId: matchedOperation.operation.operationId,
+      specSource: matchedOperation.operation.specSource,
+      target: 'request',
+    });
   }
 
   for (const headerName of Object.keys(context.exchange.request.headers)) {
-    if (shouldIgnoreHeaderAsUndocumented(headerName)) {
+    if (shouldIgnoreHeaderAsUndocumented(headerName, context.ignoreHeaders)) {
       continue;
     }
 
@@ -349,6 +389,11 @@ function createUndocumentedParameterFindings(
   return findings;
 }
 
+function isRequestRejectedByServer(context: RuleContext): boolean {
+  const response = context.exchange.response;
+  return response !== undefined && response.status >= 400 && response.status < 500;
+}
+
 function pickResponseSchema(
   context: RuleContext,
   matchedOperation: MatchedOperation
@@ -417,74 +462,83 @@ export class SchemaConsistencyRule implements TrafficRule {
     const findings: Finding[] = [];
     const cookies = parseCookies(context.exchange.request.headers.cookie);
 
+    // Undocumented query parameters and headers are a documentation gap that holds
+    // regardless of whether the server accepted the request, so report them even
+    // when the response is a 4xx.
     findings.push(...createUndocumentedParameterFindings(context, matchedOperation));
 
-    for (const parameter of matchedOperation.operation.requestParameters) {
-      if (context.ignoreCookies && parameter.in === 'cookie') {
-        continue;
-      }
+    // A 4xx response means the server rejected the request, so it never held the
+    // request to the operation's success-path contract. Validating that request
+    // against required parameters or the request-body schema would report the
+    // server's own correct rejection as drift, so skip the request-side checks.
+    if (!isRequestRejectedByServer(context)) {
+      for (const parameter of matchedOperation.operation.requestParameters) {
+        if (context.ignoreCookies && parameter.in === 'cookie') {
+          continue;
+        }
 
-      const actualValue = getActualParameterValue(parameter, context, cookies);
+        const actualValue = getActualParameterValue(parameter, context, cookies);
 
-      if (parameter.required && (actualValue === undefined || actualValue === null)) {
-        findings.push({
-          ruleId: this.id,
-          severity: 'error',
-          category: 'documentation',
-          message: `Missing required ${parameter.in} parameter: "${parameter.name}"`,
-          exchangeIndex: context.exchange.index,
-          operationId: matchedOperation.operation.operationId,
-          specSource: matchedOperation.operation.specSource,
-          target: 'request',
-        });
-        continue;
-      }
+        if (parameter.required && (actualValue === undefined || actualValue === null)) {
+          findings.push({
+            ruleId: this.id,
+            severity: 'error',
+            category: 'documentation',
+            message: `Missing required ${parameter.in} parameter: "${parameter.name}"`,
+            exchangeIndex: context.exchange.index,
+            operationId: matchedOperation.operation.operationId,
+            specSource: matchedOperation.operation.specSource,
+            target: 'request',
+          });
+          continue;
+        }
 
-      validateParameter(parameter, actualValue, context, findings);
-    }
+        validateParameter(parameter, actualValue, context, findings);
+      }
 
-    const requestContentType = context.exchange.request.contentType;
-    const requestSchema = pickSchemaByMime(
-      matchedOperation.operation.requestBodyContent,
-      requestContentType
-    );
+      const requestContentType = context.exchange.request.contentType;
+      const requestSchema = pickSchemaByMime(
+        matchedOperation.operation.requestBodyContent,
+        requestContentType
+      );
 
-    const hasRequestBody = hasBodyContent(context.exchange.request.bodyText);
+      const hasRequestBody = hasBodyContent(context.exchange.request.bodyText);
 
-    if (matchedOperation.operation.requestBodyRequired && !hasRequestBody) {
-      findings.push({
-        ruleId: this.id,
-        severity: 'error',
-        category: 'documentation',
-        message: 'Missing required request body',
-        exchangeIndex: context.exchange.index,
-        operationId: matchedOperation.operation.operationId,
-        specSource: matchedOperation.operation.specSource,
-        target: 'request',
-      });
-    }
-
-    if (requestSchema && hasRequestBody && isJsonMime(requestContentType)) {
-      if (context.exchange.request.bodyJson === undefined) {
+      if (matchedOperation.operation.requestBodyRequired && !hasRequestBody) {
         findings.push({
           ruleId: this.id,
           severity: 'error',
-          category: 'schema',
-          message: 'Request body is not valid JSON for JSON content-type',
+          category: 'documentation',
+          message: 'Missing required request body',
           exchangeIndex: context.exchange.index,
           operationId: matchedOperation.operation.operationId,
           specSource: matchedOperation.operation.specSource,
           target: 'request',
         });
-      } else {
-        findings.push(
-          ...validateSchemaResult(
-            requestSchema,
-            context.exchange.request.bodyJson,
-            context,
-            'request'
-          )
-        );
+      }
+
+      if (requestSchema && hasRequestBody && isJsonMime(requestContentType)) {
+        if (context.exchange.request.bodyJson === undefined) {
+          findings.push({
+            ruleId: this.id,
+            severity: 'error',
+            category: 'schema',
+            message: 'Request body is not valid JSON for JSON content-type',
+            exchangeIndex: context.exchange.index,
+            operationId: matchedOperation.operation.operationId,
+            specSource: matchedOperation.operation.specSource,
+            target: 'request',
+          });
+        } else {
+          findings.push(
+            ...validateSchemaResult(
+              requestSchema,
+              context.exchange.request.bodyJson,
+              context,
+              'request'
+            )
+          );
+        }
       }
     }
 
diff --git a/packages/cli/src/commands/drift/rules/builtins/security.ts b/packages/cli/src/commands/drift/rules/builtins/security.ts
index 9c92a8355e..2835f114da 100644
--- a/packages/cli/src/commands/drift/rules/builtins/security.ts
+++ b/packages/cli/src/commands/drift/rules/builtins/security.ts
@@ -1,4 +1,4 @@
-import type { Finding, RuleContext, TrafficRule } from '../../types/index.js';
+import type { Finding, NormalizedRequest, RuleContext, TrafficRule } from '../../types/index.js';
 
 interface SecuritySchemeEvaluation {
   schemeName: string;
@@ -202,7 +202,9 @@ function evaluateScheme(context: RuleContext, schemeName: string): SecuritySchem
       satisfied,
       reason: satisfied
         ? 'Authorization uses bearer token as expected for OAuth2/OpenID Connect.'
-        : `Authorization scheme "${actualAuthScheme ?? 'unknown'}" does not satisfy OAuth2/OpenID Connect (expected bearer).`,
+        : `Authorization scheme "${
+            actualAuthScheme ?? 'unknown'
+          }" does not satisfy OAuth2/OpenID Connect (expected bearer).`,
     };
   }
 
@@ -323,7 +325,9 @@ function createSecuritySummary(issues: SecurityIssue[]): string {
     return `Authentication check failed. ${optionSummaries[0]}`;
   }
 
-  return `None of the documented authentication options matched. Any one of these options would satisfy the OpenAPI security requirements: ${optionSummaries.join(' | ')}`;
+  return `None of the documented authentication options matched. Any one of these options would satisfy the OpenAPI security requirements: ${optionSummaries.join(
+    ' | '
+  )}`;
 }
 
 function getSensitiveQueryKeys(context: RuleContext): string[] {
@@ -338,12 +342,35 @@ function getSensitiveQueryKeys(context: RuleContext): string[] {
   });
 }
 
+// Mirrors the W3C Secure Contexts definition of potentially trustworthy origins:
+// localhost, *.localhost, 127.0.0.0/8, and [::1] never leave the machine.
+const LOOPBACK_HOSTNAME_PATTERN = /^(?:(?:.+\.)?localhost|127(?:\.\d{1,3}){3}|::1)$/i;
+
+function isLoopbackRequest(request: NormalizedRequest): boolean {
+  let hostname: string | undefined;
+  try {
+    hostname = new URL(request.url).hostname;
+  } catch {
+    hostname = request.host?.replace(/:\d+$/, '');
+  }
+
+  if (!hostname) {
+    return false;
+  }
+
+  return LOOPBACK_HOSTNAME_PATTERN.test(hostname.replace(/^\[|\]$/g, ''));
+}
+
 function shouldFlagInsecureTransport(context: RuleContext): {
   flag: boolean;
   hasAuthHeader: boolean;
   sensitiveQueryKeys: string[];
 } {
-  if (context.exchange.request.protocol !== 'http:' || !context.exchange.request.protocolKnown) {
+  if (
+    context.exchange.request.protocol !== 'http:' ||
+    !context.exchange.request.protocolKnown ||
+    isLoopbackRequest(context.exchange.request)
+  ) {
     return {
       flag: false,
       hasAuthHeader: false,
diff --git a/packages/cli/src/commands/drift/types/index.ts b/packages/cli/src/commands/drift/types/index.ts
index 3c4fa8f59c..3cd8e8b3c8 100644
--- a/packages/cli/src/commands/drift/types/index.ts
+++ b/packages/cli/src/commands/drift/types/index.ts
@@ -1,3 +1,5 @@
+import type { HeaderIgnoreList } from '../utils/http.js';
+
 export type MatchMode = 'strict-host' | 'basepath';
 
 export type TrafficFormat = 'auto' | 'har' | 'kong' | 'ndjson' | 'nginx-json' | 'apache-json';
@@ -91,6 +93,7 @@ export interface OpenApiParameter {
   name: string;
   in: 'query' | 'header' | 'path' | 'cookie';
   required: boolean;
+  style?: string;
   schema?: unknown;
 }
 
@@ -129,6 +132,7 @@ export interface RuleContext {
   /** Whether the request host is compatible with at least one description server. */
   hostCompatibleWithSpecServers: boolean;
   ignoreCookies?: boolean;
+  ignoreHeaders?: HeaderIgnoreList;
   validateSchema: (
     schema: unknown,
     value: unknown,
@@ -171,6 +175,8 @@ export interface RunnerOptions {
   format: TrafficFormat;
   matchMode: MatchMode;
   ignoreCookies?: boolean;
+  /** Header names/prefixes (e.g. `x-consumer-*`) to skip in undocumented-header checks. */
+  ignoreHeaders?: string[];
   previewFindingsLimit?: number;
   activeRules?: string[];
   /** Pre-loaded OpenAPI index. */
diff --git a/packages/cli/src/commands/drift/utils/http.ts b/packages/cli/src/commands/drift/utils/http.ts
index 7b4c29cd4d..07be56b9a9 100644
--- a/packages/cli/src/commands/drift/utils/http.ts
+++ b/packages/cli/src/commands/drift/utils/http.ts
@@ -238,14 +238,55 @@ export function pickSchemaByMime(
   return contentMap['*/*'];
 }
 
-export function shouldIgnoreHeaderAsUndocumented(headerName: string): boolean {
+export interface HeaderIgnoreList {
+  names: Set<string>;
+  prefixes: string[];
+}
+
+/**
+ * Turn user-supplied ignore patterns into an exact-name set and a prefix list.
+ * A pattern ending in `*` (for example `x-consumer-*`) matches every header that
+ * starts with the text before the `*`; anything else is an exact header name.
+ */
+export function parseHeaderIgnoreList(patterns: string[]): HeaderIgnoreList {
+  const names = new Set<string>();
+  const prefixes: string[] = [];
+  for (const pattern of patterns) {
+    const normalized = pattern.trim().toLowerCase();
+    if (normalized.length === 0) {
+      continue;
+    }
+    if (normalized.endsWith('*')) {
+      prefixes.push(normalized.slice(0, -1));
+    } else {
+      names.add(normalized);
+    }
+  }
+  return { names, prefixes };
+}
+
+export function shouldIgnoreHeaderAsUndocumented(
+  headerName: string,
+  extraIgnored?: HeaderIgnoreList
+): boolean {
   const normalizedHeaderName = headerName.toLowerCase();
   if (normalizedHeaderName.startsWith(':')) {
     return true;
   }
 
-  return (
+  if (
     IGNORED_UNDOCUMENTED_HEADERS.has(normalizedHeaderName) ||
     IGNORED_UNDOCUMENTED_HEADER_PREFIXES.some((prefix) => normalizedHeaderName.startsWith(prefix))
-  );
+  ) {
+    return true;
+  }
+
+  if (extraIgnored) {
+    return (
+      extraIgnored.names.has(normalizedHeaderName) ||
+      extraIgnored.prefixes.some((prefix) => normalizedHeaderName.startsWith(prefix))
+    );
+  }
+
+  return false;
 }
diff --git a/packages/cli/src/commands/proxy/index.ts b/packages/cli/src/commands/proxy/index.ts
index ad40a8d1c1..ce58338105 100644
--- a/packages/cli/src/commands/proxy/index.ts
+++ b/packages/cli/src/commands/proxy/index.ts
@@ -21,6 +21,7 @@ export type ProxyArgv = {
   'report-format': ReportFormat;
   'match-mode': MatchMode;
   'ignore-cookies'?: boolean;
+  'ignore-headers'?: string;
   'max-findings': number;
   rules?: string;
 } & VerifyConfigOptions;
@@ -75,6 +76,7 @@ export async function handleProxy({ argv, config, version }: CommandArgs<ProxyAr
       openApiIndex,
       matchMode: argv['match-mode'],
       ignoreCookies: argv['ignore-cookies'],
+      ignoreHeaders: argv['ignore-headers'] ? parseCsv(argv['ignore-headers']) : undefined,
       previewFindingsLimit: argv['max-findings'],
       activeRules: argv.rules ? parseCsv(argv.rules) : undefined,
     });
diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts
index 7fe6cffefc..776804ad9b 100644
--- a/packages/cli/src/index.ts
+++ b/packages/cli/src/index.ts
@@ -938,6 +938,11 @@ yargs(hideBin(process.argv))
             type: 'boolean',
             default: false,
           },
+          'ignore-headers': {
+            describe:
+              'Comma-separated header names to skip in undocumented-header checks. A trailing "*" matches by prefix, e.g. "x-consumer-*".',
+            type: 'string',
+          },
           'max-findings': {
             describe: 'Maximum findings shown in pretty output.',
             type: 'number',
@@ -1021,6 +1026,11 @@ yargs(hideBin(process.argv))
           type: 'boolean',
           default: false,
         },
+        'ignore-headers': {
+          describe:
+            'Comma-separated header names to skip in undocumented-header checks. A trailing "*" matches by prefix, e.g. "x-consumer-*".',
+          type: 'string',
+        },
         'max-findings': {
           describe: 'Maximum findings shown in pretty output.',
           type: 'number',