Struct Sensitive 

pub struct Sensitive<T: Default + Zeroize>(pub T);

A wrapper type for sensitive data that obscures the value in debug output and securely zeros memory when dropped.

This type is useful for wrapping secrets, passwords, API keys, and other sensitive information that should not be accidentally exposed in logs, error messages, or debug output.

The inner value remains accessible through the public field 0, but when formatted using Debug, it displays as Sensitive(****) instead of the actual value.

Type Parameters

• T: The type of the sensitive value, which must implement Default

Examples

use axum_conf::Sensitive;

let api_key = Sensitive::from("secret-key-12345");
println!("{:?}", api_key);  // Prints: Sensitive(****)

// Access the actual value when needed
let key_value: &str = &api_key.0;

Security Features

• Debug hiding: Debug output shows Sensitive(****) instead of the value
• Memory zeroing: When Sensitive<String> is dropped, the memory is securely overwritten with zeros to prevent secrets from lingering in memory

Security Limitations

This type does NOT:

• Prevent the value from being read if you have access to the Sensitive instance
• Encrypt or secure the value in memory while in use
• Prevent the value from being serialized if using Serialize
• Prevent the compiler from copying the value (use with care in generic contexts)

For true security, combine with other security measures like secure memory handling.

Derive Macros

Uses ZeroizeOnDrop from the zeroize crate to automatically zero memory when dropped.

Tuple Fields

0: T

Implementations

impl Sensitive<String>

pub fn from(s: &str) -> Self

Creates a new Sensitive<String> from a string slice.

Examples

use axum_conf::Sensitive;

let password = Sensitive::from("my-secret-password");

Trait Implementations

impl<T: Clone + Default + Zeroize> Clone for Sensitive<T>

fn clone(&self) -> Sensitive<T>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T: Default + Zeroize> Debug for Sensitive<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: Default + Default + Zeroize> Default for Sensitive<T>

fn default() -> Sensitive<T>

Returns the “default value” for a type.

impl<'de, T> Deserialize<'de> for Sensitive<T>

where T: Deserialize<'de> + Default + Zeroize,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<T: Default + Zeroize> Drop for Sensitive<T>

fn drop(&mut self)

Executes the destructor for this type.

impl<T: Default + Zeroize + PartialEq> PartialEq for Sensitive<T>

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<T> Zeroize for Sensitive<T>

where T: Zeroize + Default,

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.