Module scan 

L1 — deterministic content scan. L1 — deterministic content scan.

Single pass over static compiled rules: credentials, Korean PII, and machine-local filesystem paths. Returns byte spans, categories, severity, and an overall Sensitivity grade. Infallible — no I/O, no model.

use llm_kernel::dlp::{scan, Sensitivity};

let report = scan("Authorization: Bearer abcdefghijklmnopqrstuvwxyz012345");
assert!(report.sensitivity >= Sensitivity::Confidential);
assert!(!report.redact_spans.is_empty());

Structs

Finding

One detection.

ScanReport

Result of scan.

Span

Byte-offset range [start, end) into the scanned text.

Enums

FindingCategory

Coarse finding category (drives severity floor and sensitivity).

Severity

Severity of a single finding.

Functions

apply_redactions

Replace every span with ****, multibyte-safe.

scan

Deterministically scan context for secrets, Korean PII, and filesystem paths. Infallible: static compiled rules, no I/O.