[lucarlig]

private_key_block currently replaces only the opening PEM marker, leaving the key body and closing marker in tool output. Generic PKCS#8 and encrypted private keys also evade detection and blocking.

Match the full block through the closing marker of the same key type for RSA, DSA, EC, OpenSSH, encrypted, and generic PKCS#8 keys. If the matching closing marker is missing, redact through the end of the string. Separate complete blocks retain the text between them.

Adds Rust regressions for multiline, single-line, CRLF, repeated, truncated, mismatched-marker, and overlapping-detector cases, plus Python hook coverage for redaction, blocking, and payload isolation. Documents the behavior and bumps the plugin to 0.3.15.

Refs #162 (private-key detection/redaction item).

Validation:

• make install followed by make ci NEXTEST_PROFILE=ci: 100 Rust tests and 118 Python hook tests passed; formatting, Clippy, wheel build/install, stubs, and benchmark compilation passed.
• make plugins-validate: catalog validation and 41 repository tests passed.
• Real-CPEX import and public scanner smoke check passed.
• pre-commit run: all hooks, including secret scanning, passed. Baseline changes remove the old literal PEM fixture and refresh existing finding locations.
• Plugin-scoped cargo deny ... check advisories: passed.

The full-workspace security scan fails on existing RUSTSEC-2026-0382 in the rate limiter's rustls-webpki 0.103.15, which is also present on origin/main. Workspace bans, licenses, and sources checks passed.

[gandhipratik203]

LGTM!