pub fn render_layer_file_redacted(path: &Path) -> Result<(String, bool)>Expand description
render_layer_file with secret-shaped values replaced by [REDACTED].
A single-layer render prints the RAW file, not a MissionConfig
round-trip, so it carries keys the engine’s type never sees: the global
layer is the documented home for slack.botToken, slack.appToken and
hooks.secret, and the sandbox profiles call the file out as carrying
exactly that material. stdout reaches CI logs, screen shares, shell
transcripts and any agent that can run kranz, none of which is scrubbed
(audit 2026-09-01, MEDIUM kranz config show --global).
Two rules, belt and braces: a key whose name ends in token, secret,
key or password is redacted whatever its value (this is what catches
Slack’s xapp-… app tokens, which no value-shape rule matches), and every
surviving string still goes through kranz_engine::scrub, which catches
a credential parked under an innocuous key.