Pattern-only placeholders — not compliance-grade redaction.
Hard cap roughly 400,000 Unicode characters.
JWT runs before long-token rules to avoid shredding header segments twice.
Advanced — custom substitute (runs last)
For safety patterns are capped; catastrophic backtracks are discouraged — stick to anchored or bounded groups.