Crate forbidden_strings 

lib support for the forbidden-strings scanner.

Structs

CacheWarning

Fixed-token cache warnings remain structured for embedded event reporting. Re-exports warning value for loaded-rules output. One valid cache-warning record storing only fixed protocol tokens.

CandidateScan

Embedded consumers identify candidates independently of redacted display labels. Embedded consumers identify candidates independently of redacted display labels. Embedded consumers identify candidates independently of redacted display labels. What: Caller-owned identity plus safely displayable results from one exact candidate snapshot. Why: Matching pathname components may have identical masked labels; identity must remain independent of display text.

CompiledRules

Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the forbidden-regex rule compiler’s public surface. One compiled rule set paired with the per-rule names that drive finding identity.

Scanner

Embedded consumers identify candidates independently of redacted display labels. Embedded consumers identify candidates independently of redacted display labels. Embedded consumers identify candidates independently of redacted display labels. One loaded ruleset reused across candidate snapshots.

Enums

LoadError

Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the redacted load-error type as this module’s public failure. Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the redacted load-error type as this module’s public failure. Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the redacted load-error type as this module’s public failure. A rule-load failure with everything the rule text redacted out.

ScanFinding

Public findings contain only source locations and non-secret rule identities. What: One content/name result or explicit inability to complete a scan. Why: Enum variants keep source locations separate from operational failures without sentinel line numbers.

Constants

BUILTIN_NAMES

The builtin baseline’s rule-name sidecar, embedded at build time.

BUILTIN_PRECOMPILED

The builtin baseline precompiled into a serialized RegexSet, embedded at build time.

BUILTIN_RULES

What: pub const BUILTIN_RULES: &str = include_str!("../data/builtin-rules.txt"); declares an exported constant whose value is the entire betterleaks-ported baseline ruleset, pasted into the binary at COMPILE time by the include_str! macro. &str is a read-only view of UTF-8 bytes baked into the binary; the sibling String would heap-allocate the same bytes again at runtime for no benefit. Why: Ships the baseline inside the published binary so the opt-in --builtin-rules flag works with no rules file on disk, and lets consumers (the forbidden-regex bench crate) import the same rules instead of include_str!-ing a fragile relative path into this repository. Gotcha: Editing data/builtin-rules.txt changes nothing until the crate is rebuilt, and the file itself is GENERATED by src/mise.port-betterleaks.ts; never edit it by hand.

Functions

compile_from_text

Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the forbidden-regex rule compiler’s public surface. Compiles a rule source (autodetected format) into a combined RegexSet.

compile_rules

Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the forbidden-regex rule compiler’s public surface. Compiles a rule source into a combined RegexSet plus its per-rule names.

load_precompiled

Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the forbidden-regex rule compiler’s public surface. Re-exports the forbidden-regex rule compiler’s public surface. Loads a precompiled serialized RegexSet from bytes.

run_cli_from_env

Run the scanner from real process arguments and environment values.