An embedded object we could not open
A document embedded inside this one could not be opened, so whatever it contains was not analysed.
How the text is hidden
Word, Excel and PowerPoint all let a whole other file be dropped inside a document as an embedded object, stored complete under word/embeddings/, ppt/embeddings/ or xl/embeddings/. Sometimes that part is the file itself; sometimes it is an OLE compound file whose root holds a \x01Ole10Native stream wrapping the real document. Either way the payload sits one level down, out of reach of anything that reads only the outer body.
Why a model still reads it
Concealment inside an embedded document behaves exactly as it would at top level, once something opens the object. The engine's own code comment records the failure this closed: the identical payload returned hostile at top level and clean, certified: true, no findings and no gaps one level down.
What we do about it
Every part matching <word|ppt|xl>/embeddings/… is inflated, unwrapped from an OLE-native stream when it is one, and handed to a full recursive analysis; findings from inside keep their own technique, severity and instructionShaped, with location.part rewritten to <embedding path> → <inner part>. This technique fires only for objects that were NOT opened — past MAX_EMBEDDED_PER_DOCUMENT, past MAX_EMBED_DEPTH, undecodable, or a format the engine does not parse — gathered into one informational disclosure naming each part with its reason. action: "disclosed", chars: 0; nothing is stripped or flagged, and certified goes false.
How often it fires
Not measured. We publish a rate only where one has been measured against a named corpus of the right format, and no figure exists for this technique yet. Absence means unknown — never low.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API