pub const RULES_VERSION: u32 = 7;Expand description
The versioned redaction rule set. Bump on any rule change; recorded in the bundle manifest.
v2 added field-name-driven private-key/seed redaction ([SENSITIVE_KV], [KEY_PHRASE]) and
numbered-mnemonic detection, over v1’s PEM + token/auth + narrow mnemonic set.
v3 → v4: fixed AUTH_HEADER and BEARER to redact full standard-base64 credentials (including +/= chars).
v4 → v5 (defense-in-depth residuals): the generic key/keystore names are now scrubbed when
their VALUE looks like raw secret material ([CONDITIONAL_SENSITIVE]); [KEY_PHRASE] covers
identity|node|master|ed25519|bls|api prose forms; positional Debug shapes with no separator
(PrivKey(…)/Seed([…])/Mnemonic("…")) are caught by [SECRET_DEBUG_TUPLE]; and the priv
substring rule is tightened to private-key markers so privacy/private-beta are not over-scrubbed.
v5 → v6 (#723): [SECRET_DEBUG_TUPLE] became SUFFIX-driven instead of a fixed whole-name list, so
prefixed/aliased secret types (ExtendedPrivKey(…), MasterSecret(…), BlsSk(…), Ed25519Sk(…))
are now caught; Sk is matched case-sensitively so Task(…)/Disk(…) stay unscathed.
v6 → v7 (#730): [SECRET_DEBUG_BRACE] extends the same suffix-driven type-marker set to the
named-field BRACE Debug shape (SigningKey { scalar: <hex> }), which evaded both the bracket-only
tuple detector and the field-name kv rule when the field name was non-sensitive.