Four one-line renderings of a private key leak its body past the PEM rules. The same-line pattern's separator (pemPrivateKeyPattern, internal/adapter/scanner/patterns.go) admits a blank, a comma, a quote and an escaped newline but not an escaped quote, so a JSON array serialised inside a JSON string (the elements joined by backslash-quote-comma-backslash-quote) masks the header and keeps the body verbatim on the header's line; an HTML rendering that joins the lines with `<br>` or the `&#10;` entity leaks the same way; and a header whose case a tool lowered is not detected at all, by the pattern or by the block consumer (pem.go pemBegin/pemEnd), so its whole body is stored. Found by the scanner-cluster review (items 4 and 5).

Four one-line renderings of a private key leak its body past the PEM rules. The same-line pattern's separator (pemPrivateKeyPattern, internal/adapter/scanner/patterns.go) admits a blank, a comma, a quote and an escaped newline but not an escaped quote, so a JSON array serialised inside a JSON string (the elements joined by backslash-quote-comma-backslash-quote) masks the header and keeps the body verbatim on the header's line; an HTML rendering that joins the lines with <br> or the 
 entity leaks the same way; and a header whose case a tool lowered is not detected at all, by the pattern or by the block consumer (pem.go pemBegin/pemEnd), so its whole body is stored. Found by the scanner-cluster review (items 4 and 5).

Grounds

• pursued: a private key rendered on one line with escaped-quote, <br> or entity separators, or under lower-cased markers, is masked through its END marker; one of those renderings leaving a body chunk in the redacted text would show it wrong.