Issues

• suppressions: a misspelled expires_at makes a lapsed rule permanent, and every save strips comments and unknown keys

  bugdocumentationP2
  awslabs/ferret-scan#866 · Filter by author sectoramen opened on Nov 4, 2026 · v2.6.0

• redaction: audit log fields are not taken from the run — version, summary, per-entry confidence and strategy

  bugdocumentationP2
  awslabs/ferret-scan#865 · Filter by author sectoramen opened on Nov 4, 2026 · v2.6.0

• redaction: 21 of 24 email types skip the email renderer — simple names the provider, the default drops the domain

  bugP2
  awslabs/ferret-scan#864 · Filter by author sectoramen opened on Nov 4, 2026 · v2.6.0

• redaction: audio, video and legacy Office silently write format_preserving for simple and a mask for synthetic

  buggoP2
  awslabs/ferret-scan#863 · Filter by author sectoramen opened on Nov 4, 2026 · v2.6.0

• bankaccount: spaced IBAN followed by a short word dropped; dash grouping never matched; 15 registry countries missing

  buggoP1
  awslabs/ferret-scan#862 · Filter by author sectoramen opened on Nov 4, 2026 · v2.6.0

• driverslicense: British and "driving" labels are missed or band-demoted; GB DVLA and printed ON/QC numbers never match

  bugdocumentationenhancementP2
  awslabs/ferret-scan#861 · Filter by author sectoramen opened on Nov 4, 2026 · v2.6.0

• vin: a non-North-American VIN without check digit is dropped, even under a VIN: label, unless its WMI is hard-coded

  buggoP2
  awslabs/ferret-scan#860 · Filter by author sectoramen opened on Nov 4, 2026 · v2.6.0

• medicalid: UK NHS and Scottish CHI numbers have no owning type; they report as US/CA PHONE (last 4 kept) or not at all

  enhancementgoP2
  awslabs/ferret-scan#859 · Filter by author sectoramen opened on Nov 4, 2026 · v2.6.0

• medicalid: lowercase MBIs, 11 of 18 DEA registrant letters and the business '9' form never match; redaction skips them

  buggoP2
  awslabs/ferret-scan#858 · Filter by author sectoramen opened on Nov 4, 2026 · v2.6.0

• dob: dates of birth directly after an explicit label are missed in standard shapes (ISO 8601 date-time, DD-MON-YYYY)

  bugP1
  awslabs/ferret-scan#857 · Filter by author sectoramen opened on Nov 4, 2026 · v2.6.0

• email: the embedded IANA TLD snapshot has drifted from the root zone

  tld-snapshot
  awslabs/ferret-scan#854 · Filter by author github-actions opened on Nov 2, 2026

• secrets: dashed/alt placeholder values (your-api-key, REPLACE_ME) are reported as credentials

  buggoP3
  awslabs/ferret-scan#850 · Filter by author sectoramen opened on Oct 29, 2026 · v2.6.0

• context: finish #788 — whole-document 2000-char typing, over-broad TSV/CSV boosts, and the dead YAML branch

  buggoP2
  awslabs/ferret-scan#849 · Filter by author sectoramen opened on Oct 29, 2026 · v2.6.0

• goldencorpus: the metadata-key census conflicts across parallel PRs like CHANGELOG did before #832

  enhancementP3
  awslabs/ferret-scan#841 · Filter by author sectoramen opened on Oct 29, 2026 · v2.6.0
  1

• perfguard: calibrated fixture spans under MinTicks on windows-latest when the wall tick coarsens between calibration and measurement

  buggoP2
  awslabs/ferret-scan#840 · Filter by author sectoramen opened on Oct 29, 2026 · v2.6.0

• Audit tracking: 51 measured detection/redaction items (2026-10)

  documentation
  awslabs/ferret-scan#774 · Filter by author sectoramen opened on Oct 14, 2026
  

• metadata: a provenance value reaches 100 HIGH when the product name contains a validator keyword (7 validators)

  awslabs/ferret-scan#692 · Filter by author sectoramen opened on Sep 15, 2026
  

• cross-validator deconfliction: 5.15% of findings are sub-spans of a wider, more-confident finding, and only redaction knows it

  awslabs/ferret-scan#687 · Filter by author sectoramen opened on Sep 15, 2026
  

• validators: every finding's metadata map sits exactly at a Go bucket cliff — the next key added costs ~342 B per finding

  awslabs/ferret-scan#621 · Filter by author sectoramen opened on Sep 9, 2026
  3

  

• Trust-boundary decision for a config discovered inside the scan target: opt-in gating, a THREAT_MODEL entry, and the pre-commit gate that silences the provenance disclosure

  awslabs/ferret-scan#293 · Filter by author sectoramen opened on Aug 12, 2026
  4