diff --git a/internal/policy/policy.go b/internal/policy/policy.go
index 2fd62fa..46edb5c 100644
--- a/internal/policy/policy.go
+++ b/internal/policy/policy.go
@@ -744,11 +744,13 @@ func (p *Policy) scan(input []string, scanner Scanner, cd CustomPolicyDetector,
 						continue
 					}
 
-					if sr.Action != Block && sr.Action != AllowButWarn {
-						sr.Action = AllowButRedact
-					}
+					if regex.MatchString(text) {
+						replaced = regex.ReplaceAllString(text, "***")
 
-					replaced = regex.ReplaceAllString(text, "***")
+						if sr.Action != Block && sr.Action != AllowButWarn {
+							sr.Action = AllowButRedact
+						}
+					}
 				}
 			}