Redaction was flagged as the heaviest review from the day it was planned, because in this one feature a bug is a disclosure. The first round proved the point.
What the reviewer found
Rather than read the code, the reviewer wrote two dozen independent checks that take the “verified” redacted copy and hunt for the text that is supposed to be gone. Four of them found it. Text drawn inside a repeating fill pattern was never scanned. A rule that exempted a word already visible elsewhere on the page let a short name through because it happened to be a substring of a longer visible word. A document embedded inside the document was decoded only one level down. And a glyph drawn as an outline, where the path crosses the edge of the mark, survived.
The conservative fixes
The manager chose the strict option in every case rather than the clever one. Patterns are redacted the way forms are, or the apply is refused. Matching is whole-word, and every string that is not page text, links, bookmarks, structure text, and metadata, is always scanned. Attachments get a Remove attachments option and are otherwise refused. A filled sub-path wholly inside a mark is dropped. A link under a mark is removed. And an unsaved password change is refused before redacting, the same rule Compress already follows.
The principle written down with the fixes: every finding is a leak, not a limit, and where the builder cannot prove removal the app refuses to write the copy.