Struct SecurityCandidate 

pub struct SecurityCandidate {
    pub source_kind: Option<String>,
    pub sink: SecurityCandidateSink,
    pub boundary: SecurityCandidateBoundary,
    pub network: Option<SecurityNetworkContext>,
}

An agent-actionable candidate record on a SecurityFinding. fallow fills source_kind, sink, and boundary. The exploitability IMPACT is deliberately NOT a field: deciding severity / exploitability is the consuming agent’s job, not fallow’s, and a perpetually-null impact key would only train consumers to ignore it. The agent reads this record, then writes its own impact verdict downstream.

Fields

source_kind: Option<String>

The kind of untrusted input that reaches the sink, as a stable catalogue source id ("http-request-input", "process-env", "process-argv", "message-event-data", "location-input", …). None/absent when no untrusted source was matched (always None for client-server-leak). This is an OPEN string set, driven by the data-driven source catalogue; a consumer should treat an unknown id as “untrusted source of unknown kind” and never drop the candidate on that basis.

sink: SecurityCandidateSink

The sink the candidate fires on, self-contained so the record is actionable without reading the parent finding.

boundary: SecurityCandidateBoundary

The structural boundary the flow crosses.

network: Option<SecurityNetworkContext>

Network-destination context, present only on secret-to-network (#890) candidates: the host the secret-bearing call targets, so an agent can triage exfil from intended auth. Absent for every other category.

Trait Implementations

impl Clone for SecurityCandidate

fn clone(&self) -> SecurityCandidate

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityCandidate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityCandidate

fn default() -> SecurityCandidate

Returns the “default value” for a type.

impl Eq for SecurityCandidate

impl PartialEq for SecurityCandidate

fn eq(&self, other: &SecurityCandidate) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SecurityCandidate

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecurityCandidate