{"version":"2.1.271","anchor":"sensitive-data-redaction-split-into-context-pass-and-token-p","canonical_anchor":"sensitive-data-redaction-split-into-context-pass-and-token-p","heading":"Sensitive-data redaction split into context-pass and token-pass with confidence tiers","tier":"internal","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271\/e\/sensitive-data-redaction-split-into-context-pass-and-token-p","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271","markdown":"### Sensitive-data redaction split into context-pass and token-pass with confidence tiers\n\nSensitive-data redaction now runs in two passes split by confidence level\n\n**Unclear.** The finding doesn't say why the two passes need to be separate or what different treatment each receives.\n\n**What**\n\nThe logic that redacts sensitive data (for example, before sending logs or telemetry) is now split into two passes: `redactContext`, which applies only rules marked \"low\" confidence, and `redactTokens`, which applies only rules marked \"high\" confidence. Both are combined together in the overall `redact()` function, replacing a single pass that applied all rules uniformly.\n\n**Why**\n\nSeparating redaction by confidence tier likely allows each pass to be applied differently or tuned independently, rather than treating all matches the same regardless of how confident the match is.\n\n- Area: Elsewhere\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 2\/5"}