har record printed no scrub line and the Cookie header is still sitting in the file

We only have one project registered, so I have got into the habit of leaving -p off and letting it pick.

bun run sdods har record -e staging -t @har:cart

Recorded fine, scenario replays. But there was no line like this at the end, which I have seen on every other recording I have made:

scrubbed 214 credential value(s) from 3 HAR file(s)

And sure enough the Cookie header in har/staging/cart.har is the real value, not ***. Ran the identical command again with -p demo-shop in front of it and it scrubbed on the spot.

So the scrub appears to be skipped when the project is resolved rather than passed. Is that deliberate, or should I be filing it? Asking because "credentials are only stripped when you happen to type a flag" is a slightly alarming shape for a safety net.