Struct RawMatch 

pub struct RawMatch {
    pub detector_id: Arc<str>,
    pub detector_name: Arc<str>,
    pub service: Arc<str>,
    pub severity: Severity,
    pub credential: Arc<str>,
    pub credential_hash: String,
    pub companions: HashMap<String, String>,
    pub location: MatchLocation,
    pub entropy: Option<f64>,
    pub confidence: Option<f64>,
}

A raw pattern match before verification or deduplication.

entropy and confidence are stored as f64 but are guaranteed never to be NaN (sanitized at construction time). This keeps the manual Eq impl reflexive, which downstream code relies on for HashMap/BTreeMap keys.

Manual Debug impl redacts the credential field — the previous derive-Debug was a CRITICAL leak vector (any {:?} print, panic handler, or tracing::error!(?match) would expose plaintext). See audit kimi-wave1 finding 1.1.

Fields

detector_id: Arc<str>

Stable detector identifier.

detector_name: Arc<str>

Human-readable detector name.

service: Arc<str>

Service namespace associated with the detector.

severity: Severity

Detector severity level.

credential: Arc<str>

Matched credential bytes before redaction.

credential_hash: String

SHA-256 hash of the credential for allowlisting and deduplication.

companions: HashMap<String, String>

Companion credential or context value extracted nearby.

location: MatchLocation

Source location for the match.

entropy: Option<f64>

Shannon entropy of the matched credential (0.0 - 8.0). NaN-sanitized.

confidence: Option<f64>

Confidence score (0.0 - 1.0). NaN-sanitized at construction.

Implementations

impl RawMatch

pub fn sanitize_floats(self) -> Self

Replace NaN floats with None so the manual Eq impl stays reflexive and HashMap/BTreeMap lookups don’t trap. Call this on any externally constructed RawMatch (deserialized findings, scanner outputs).

impl RawMatch

pub fn deduplication_key(&self) -> (&str, &str)

Get unique key for deduplication.

pub fn to_redacted(&self) -> RedactedFinding

Convert into a serialization-safe DTO that never carries the plaintext credential. Use this anywhere a RawMatch would otherwise be written to disk, sent over the network, or rendered into a user-visible report. See kimi-wave1 audit finding 2.1 (scan_system.rs JSON exfil).

Trait Implementations

impl Clone for RawMatch

fn clone(&self) -> RawMatch

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RawMatch

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Redacted Debug. Replaces derive(Debug) which would print the raw credential: Arc<str> plaintext. See kimi-wave1 audit finding 1.1. credential_hash is preserved because it’s already a one-way SHA-256.

impl<'de> Deserialize<'de> for RawMatch

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Ord for RawMatch

fn cmp(&self, other: &Self) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for RawMatch

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for RawMatch

fn partial_cmp(&self, other: &Self) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for RawMatch

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for RawMatch