pub fn mask_secrets(text: &str) -> Cow<'_, str>Expand description
Redact every detected secret span in text, replacing each with
***MASKED***.
This is the masking counterpart to check: where check hard-blocks a
write on the first match, mask_secrets is for content that must be STORED
with credentials stripped (the session mirror). It reuses the SAME
canonical detector set as check/scan, so callers must never maintain a
second, weaker masker.
Returns Cow::Borrowed when no secret is present (the common case), avoiding
an allocation. Spans are discovered left to right against the ORIGINAL text,
always evaluating trigger context over the full input — a high-entropy value
whose only trigger word sits to the left of an earlier-redacted secret is
still detected. See docs/api/secret_gate.md#mask_secrets for the scan-cursor
mechanics.