diff --git a/rustfs/tests/connect_profile_memory.rs b/rustfs/tests/connect_profile_memory.rs
index e00b56173..42e25dbd6 100644
--- a/rustfs/tests/connect_profile_memory.rs
+++ b/rustfs/tests/connect_profile_memory.rs
@@ -104,6 +104,12 @@ fn stats(bytes: u64, count: u64) -> String {
     )
 }
 
+fn nested_string_stats(bytes: u64, count: u64) -> String {
+    format!(
+        r#"{{"process":{{"malloc_normal":{{"total":"{bytes}"}},"malloc_huge":{{"total":"0"}},"malloc_normal_count":{{"total":"{count}"}},"malloc_huge_count":{{"total":"0"}}}}}}"#
+    )
+}
+
 fn archive_entry(archive: &mut ZipArchive<Cursor<Vec<u8>>>, name: &str) -> Vec<u8> {
     let mut entry = archive.by_name(name).expect("archive entry");
     let mut bytes = Vec::new();
@@ -206,6 +212,23 @@ async fn memory_profile_uses_only_bounded_allocator_aggregates() {
     assert!(matches!(parse_allocator_stats(&oversized), Err(ProfileError::SourceUnavailable)));
 }
 
+#[tokio::test(start_paused = true)]
+async fn memory_profile_accepts_nested_string_mimalloc_totals() {
+    let _guard = TEST_PROFILE_LOCK.lock().await;
+    let first = Box::leak(nested_string_stats(1_000, 20).into_boxed_str());
+    let second = Box::leak(nested_string_stats(1_250, 24).into_boxed_str());
+    let source = SequenceSource::new(first, second);
+    let key = connect::DeviceIdentity::generate();
+    let export = export_memory_profile_from(&request(), &key, &CancellationToken::new(), &source)
+        .await
+        .expect("nested aggregate export");
+    let mut archive = ZipArchive::new(Cursor::new(export.archive_bytes)).expect("profile archive");
+    let result: serde_json::Value = serde_json::from_slice(&archive_entry(&mut archive, "result.json")).expect("result JSON");
+
+    assert_eq!(result["data"]["allocatedBytes"], 250);
+    assert_eq!(result["data"]["allocationCount"], 4);
+}
+
 #[tokio::test]
 async fn memory_profile_allows_only_one_collector_at_a_time() {
     let _guard = TEST_PROFILE_LOCK.lock().await;
diff --git a/scripts/check_embedded_secrets.sh b/scripts/check_embedded_secrets.sh
index 720111af3..096969d44 100755
--- a/scripts/check_embedded_secrets.sh
+++ b/scripts/check_embedded_secrets.sh
@@ -110,6 +110,8 @@ PATTERNS=(
 #      both unusable: 6 is a PKCS#8 wrapper whose OCTET STRING declares 32
 #      bytes and holds the 7 ASCII bytes "example", and 7 spells out in the
 #      body that it is not a real key.
+# 8: rustfs/tests/fixtures/connect-logs-v1.json includes an explicitly
+#    synthetic PEM-shaped value to prove log redaction removes key material.
 AWS_EXAMPLE_STEM="AKIAIOSFODNN7EXAMPL"
 AGENT_FIXTURE_RSA_BODY="MIIEowIBAAKCAQEAxEXAMPLEKEYBODYnotarealkey0000000000000000000000"
 NON_SECRET_LITERALS=(
@@ -120,6 +122,7 @@ NON_SECRET_LITERALS=(
     "\"-----${BEGIN_MARK} PRIVATE KEY-----\""
     "-----${BEGIN_MARK} PRIVATE KEY-----\\nMEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCBleGFtcGxl\\n-----END PRIVATE KEY-----"
     "-----${BEGIN_MARK} RSA PRIVATE KEY-----\\n${AGENT_FIXTURE_RSA_BODY}\\nEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE=\\n-----END RSA PRIVATE KEY-----"
+    "-----${BEGIN_MARK} PRIVATE KEY-----\\nSYNTHETIC_PRIVATE_KEY_BYTES\\n-----END PRIVATE KEY-----"
 )
 
 run_scan() {