the memory lint's degraded-scanner finding carries a per-repo pattern name into report.md unsanitised. Lint builds an MR001 message from openStoreRedactor's error, whose text includes the pattern name read from .abcd/config/pii.json, and renderLintReportMD writes that message into the local-tier report.md with no termsafe pass; the CLI render sanitises, the file render does not. A hostile or careless pattern name therefore reaches a file the operator opens in a pager. Recorded from a security review of the memory-store lane; not fixed there, and the file report is local-tier rather than committed, so the exposure is one terminal read.

the memory lint's degraded-scanner finding carries a per-repo pattern name into report.md unsanitised. Lint builds an MR001 message from openStoreRedactor's error, whose text includes the pattern name read from .abcd/config/pii.json, and renderLintReportMD writes that message into the local-tier report.md with no termsafe pass; the CLI render sanitises, the file render does not. A hostile or careless pattern name therefore reaches a file the operator opens in a pager. Recorded from a security review of the memory-store lane; not fixed there, and the file report is local-tier rather than committed, so the exposure is one terminal read.

Grounds

• pursued: sanitising at the one render that writes report.md makes the file and the CLI agree on the same finding; a control, bidi or zero-width rune from a finding reaching report.md raw would show it wrong