Module scrub 

Save-time secret scrubbing (scrub_secrets, ScrubConfig). Secret scrubbing applied to entry content before persistence.

This module is pure (no I/O): it compiles a fixed set of regular expressions once and applies them to redact common credential formats (cloud provider keys, API tokens, private key blocks, JWTs, bearer tokens) before content reaches storage.

See the crate-level # Security section for the untrusted-memory doctrine that governs how retrieved content must be treated by callers.

Structs

ScrubConfig

Configuration for secret scrubbing.

Functions

scrub_secrets

Scrub known secret formats from text, replacing each match with [REDACTED:<label>].