reporting.py:_normalize_finding applies redact() to description/proof/confidence_reason but never to target; notification_service.py embeds finding.get('target') in subjects/Slack payloads without redact(). Internal hostnames/IPs/credentials embedded in target leak in every format.
Fix: apply redact() to target and walk evidence values with recursive redaction.
reporting.py:_normalize_finding applies redact() to description/proof/confidence_reason but never to target; notification_service.py embeds finding.get('target') in subjects/Slack payloads without redact(). Internal hostnames/IPs/credentials embedded in target leak in every format.
Fix: apply redact() to target and walk evidence values with recursive redaction.