A default mode:"replace" regex matching every non-whitespace candidate (e.g. \S{n}) shipped the raw secret unchanged when its deterministic replacement collided with the value: every alphanumeric/punctuation candidate still matched. Add a same-length whitespace (space/tab) fallback tier to the redaction search, which \S-style patterns never re-match, so the secret is redacted to a stable nonmatching value. A match-everything regex (./[\s\S]) matches whitespace too and still keeps the sentinel.
Refs #2465
Mathews-Tom
bfdb4f4ea2