Struct Sensitive 

pub struct Sensitive<T> { /* private fields */ }

Wraps a secret so Debug and Display always render "[REDACTED]" while the value stays usable through Sensitive::expose.

Deliberately attribute-free: no derive macros, so nothing can accidentally drift into leaking. The redacting impls carry no T: Debug/T: Display bound, which means a container’s derived Debug also renders "[REDACTED]" for the field — the value cannot escape through any formatting path.

Deserialization is always supported (loading configuration is the point). Serialization is opt-in behind the serde feature, because serializing secrets invites accidental disclosure — enable it only when your pipeline genuinely needs to write the value back out. Every intentional read goes through expose, which makes secret usage grep-friendly: grep -rn '\.expose()' audits every touchpoint.

Example

use config_kit::Sensitive;

let token = Sensitive::new("hunter2".to_owned());
assert_eq!(format!("{token:?}"), "[REDACTED]");
assert_eq!(format!("{token}"), "[REDACTED]");
assert_eq!(token.expose(), "hunter2");

Implementations

impl<T> Sensitive<T>

pub fn new(value: T) -> Self

Wraps value for redacted transport.

pub fn expose(&self) -> &T

Explicit, grep-friendly access to the wrapped secret.

pub fn into_inner(self) -> T

Consumes the wrapper, returning the secret. Like expose, this is an explicit declassification point.

Trait Implementations

impl<T> Debug for Sensitive<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, T> Deserialize<'de> for Sensitive<T>

where T: Deserialize<'de>,

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<T> Display for Sensitive<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T> From<T> for Sensitive<T>

fn from(value: T) -> Self

Converts to this type from the input type.