{"version":"2.1.234","anchor":"pem-private-key-redaction-rewritten-to-avoid-pathological-sc","canonical_anchor":"pem-private-key-redaction-rewritten-to-avoid-pathological-sc","heading":"PEM private-key redaction rewritten to avoid pathological scanning","tier":"notice","area":"Secret Redaction","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/pem-private-key-redaction-rewritten-to-avoid-pathological-sc","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### PEM private-key redaction rewritten to avoid pathological scanning\n\nPrivate-key redaction no longer stalls on large or malformed input.\n\n**What**\n\nThe secret scanner that strips private keys out of text before it leaves the session no longer uses one large regex spanning the whole key block, which could stall on big or malformed input. It now finds BEGIN and END lines separately and splices out what lies between them.\n\n**Details**\n\n- Two case-insensitive global patterns, one for the header and one for the footer, matched in sequence with a minimum 64-character gap between them.\n- Each matched region is replaced with `[REDACTED]`.\n\n**Evidence**\n\n`PRIVATE KEY(?: BLOCK)?-----`\n\n- Area: Secret Redaction\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}