When Heimdall operates in proxy mode, it constructs the "Forwarded" HTTP header after executing the matched rule pipeline by inserting the incoming request's "Host" header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the "Forwarded" header, potentially spoofing IP addresses for upstream services.