Unclear The finding doesn't say why the two passes need to be separate or what different treatment each receives.
What
The logic that redacts sensitive data (for example, before sending logs or telemetry) is now split into two passes: redactContext, which applies only rules marked "low" confidence, and redactTokens, which applies only rules marked "high" confidence. Both are combined together in the overall redact() function, replacing a single pass that applied all rules uniformly.
Why
Separating redaction by confidence tier likely allows each pass to be applied differently or tuned independently, rather than treating all matches the same regardless of how confident the match is.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
The finding doesn't say why the two passes need to be separate or what different treatment each receives.