cloud-sdk-sanitization

Provider-neutral cleanup and secret-handling boundary for the main cloud-sdk workspace and cloud-sdk crate.

This crate provides the mandatory volatile cleanup primitive used by the default no_std SDK plus reusable caller-owned guards. It delegates clearing to the independently reviewed sanitization crate with default features disabled.

Install

[dependencies]
cloud-sdk = "0.38.0"
cloud-sdk-sanitization = "0.16.0"

Example

use cloud_sdk_sanitization::SecretBuffer;

let mut output = [0_u8; 128];
{
    let mut guarded = SecretBuffer::new(&mut output);
    guarded.as_mut_slice()[..6].copy_from_slice(b"secret");
    assert_eq!(&guarded.as_slice()[..6], b"secret");
}
assert_eq!(output, [0_u8; 128]);

With the optional alloc feature, the reviewed sanitization::SecretString is re-exported. It consumes an owned String without copying its plaintext bytes, restricts access to checked closures, and volatile-clears the full allocation capacity on drop:

# #[cfg(feature = "alloc")]
# fn main() {
extern crate alloc;

use alloc::string::String;
use cloud_sdk_sanitization::SecretString;

let secret = SecretString::from_string(String::from("temporary secret"));
assert_eq!(
    secret.try_with_secret(|value| value == "temporary secret"),
    Ok(true)
);
assert!(!alloc::format!("{secret:?}").contains("temporary secret"));
# }
# #[cfg(not(feature = "alloc"))]
# fn main() {}

Features

Docs.rs builds with all features. The underlying sanitization dependency keeps its default features disabled in every configuration.

Security Notes

SecretBuffer volatile-clears its entire borrowed slice on drop, including after early returns and unwind where unwind exists. SecretString clears its full owned allocation capacity on drop and clears old allocations before growth. sanitize_bytes provides the reviewed byte primitive used by core; sanitize_value applies the same boundary to scalar lifecycle state.

These helpers do not clear immutable source strings or copies made by transports, operating systems, crash handlers, swap, remote services, or other processes. They also do not replace review of token ownership, logging, environment variables, paging, compiler behavior, or process boundaries.