A commit that deletes a private address still carries it on the minus side of its own diff, so the history scan flags the repair as well as the leak.
Both are reviewed; neither is reachable text any more.
The commit that added the absolute buildDir and the one that removes it both carry it in their diffs, so the history scan flags them forever.
Allowlisting is the only exit that does not rewrite history two forges already hold.
Tags now cross only after the release gates. Public assets are read back anonymously and hashed; the Rust Action pin now names its advertised stable commit.
