Module credential 

Secure credential storage and redaction. Opaque, zeroize-on-drop credential bytes.

Replaces the previous Arc<str> credential field with a type that:

1. Zeroes its bytes on drop (zeroize crate). Heap pages keyhog freed while a scan was in flight no longer leak credentials to the next allocator request, swap, or post-mortem core dump.
2. Refuses Debug / Display printing — every leak path through {:?} or {} becomes <redacted N bytes> instead of the bytes themselves. To get the bytes you must call expose_secret() explicitly, which grep’ing the codebase for can audit every credential touch site.
3. Is Clone and serializable via serde (uses the expose_secret() bytes for Serialize, decodes back to a fresh Credential for Deserialize). The serialization channel is the responsibility of the caller — find emitters that go to disk/JSON and either redact them or wrap the entire output in EnvSeal seal.

When EnvSeal embeds keyhog, this type is the only place credential bytes ever appear in process memory; an mlock + memfd backing can be added behind the lockdown feature gate without touching call sites.

Structs

Credential

Opaque credential bytes. The inner Arc<Zeroizing<Box<[u8]>>> clones are cheap (refcount bump) but every owning Credential zeroizes on drop. Arc lets the engine intern identical credentials without copying; when the last ref drops, Zeroizing<Box<[u8]>> overwrites the heap allocation before Box::drop returns it to the allocator.

SensitiveString

A heap-allocated string that is zeroized on drop.