GHSA-5qr6-f78x-g2cx (CWE-312): the memory store redacts only the PEM BEGIN header and stores the key body. memory.storeRedactor.redactText scans with the header-only pem_private_key pattern, scanner.Redact masks that one span, and the stage-two BlockingResidual rescan re-runs the same rule over a fingerprinted header and is clean by construction; a text source with a key block lands in the page body and in the --keep-original copy (redactOriginalBytes) with body and END line verbatim. Evidence: memory/redact.go redactText and redactOriginalBytes. The fix is the shared block consumer in scanner.Redact so memory, history and capture cannot drift; the page body and the kept original must carry no body line.

GHSA-5qr6-f78x-g2cx (CWE-312): the memory store redacts only the PEM BEGIN header and stores the key body. memory.storeRedactor.redactText scans with the header-only pem_private_key pattern, scanner.Redact masks that one span, and the stage-two BlockingResidual rescan re-runs the same rule over a fingerprinted header and is clean by construction; a text source with a key block lands in the page body and in the --keep-original copy (redactOriginalBytes) with body and END line verbatim. Evidence: memory/redact.go redactText and redactOriginalBytes. The fix is the shared block consumer in scanner.Redact so memory, history and capture cannot drift; the page body and the kept original must carry no body line.

Grounds

• pursued: the header is the only detectable part of a key block, so the redaction has to consume what the header announces; done once in scanner.Redact so the four committed stores cannot drift, bounded by line shape and by a line count so a truncated block never swallows a record