A closing tag in the text
A </document>-style delimiter typed into the document body, where it can read as the end of your data and the start of your instructions.
How the text is hidden
Nothing here is concealed. The characters are ordinary visible text sitting in the body, a header, a note or any other part the parser reads, and they take their power entirely from where they land. They become dangerous only after your own prompt assembly wraps the extracted text in a delimiter of the same shape: at that point the model holds one flat string, and a tag the document supplied looks exactly like a tag your code supplied. The rule pack's pattern matches an opening or closing document tag case-insensitively with arbitrary internal whitespace, so < / DOCUMENT > is the same hit as </document>.
Why a model still reads it
The model never sees your file — it sees the string your code built around the extracted text. A delimiter written inside the document is, by then, indistinguishable from the one your code added, so everything after it reads as instructions from you rather than as counterparty content.
What we do about it
The scan runs over the assembled canonical text, after family-C codepoint stripping — that order is deliberate, so a zero-width character wedged inside </docu…ment> cannot hide the marker from the pattern that exists to neutralise it. The pattern, its flags and the replacement string are all read from the rule pack's structuralMarkers list, never from engine code. A match is replaced with the visible token [ scrubbed-prompt-marker ] rather than deleted, so text.canonical shows a reviewer that something was there. Where two markers overlap, the earliest-starting and longest match wins and the reported count is the number of replacements actually made, not the number of raw regex matches. The finding is family: "marker", severity: "informational", action: "marked" — never escalated and never graded by provenance — so the verdict stays clean while summary.certified goes false with notCertifiedReason: "informational-findings-present".
How often it fires
Not measured. We publish a rate only where one has been measured against a named corpus of the right format, and no figure exists for this technique yet. Absence means unknown — never low.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API