Struct SecretBrokerPolicy 

pub struct SecretBrokerPolicy {
    pub enabled: bool,
    pub secret_suffixes: Vec<String>,
    pub secret_prefixes: Vec<String>,
    pub secret_exact: Vec<String>,
    pub disclosure_allowlist: Vec<String>,
    pub redaction_placeholder: String,
}

Patterns used to identify environment variables likely to contain secrets.

The broker uses suffix and prefix matching to catch common naming conventions for API keys, tokens, passwords, and credentials.

Fields

enabled: bool

When true, the secret broker is active.

secret_suffixes: Vec<String>

Env var name suffixes that indicate a secret (case-insensitive).

secret_prefixes: Vec<String>

Env var name prefixes that indicate a secret (case-insensitive).

secret_exact: Vec<String>

Exact env var names that are always treated as secrets (case-insensitive).

disclosure_allowlist: Vec<String>

Env vars on this list are never redacted, even if they match a pattern.

redaction_placeholder: String

The replacement string used in place of secret values.

Implementations

impl SecretBrokerPolicy

pub fn is_secret(&self, name: &str) -> bool

Returns true if the given env var name matches a known secret pattern.

pub fn maybe_redact<'a>(&'a self, name: &str, value: &'a str) -> &'a str

Redact a value if the env var name is a secret.

Returns the original value if not a secret, or the redaction placeholder if it is.

Trait Implementations

impl Clone for SecretBrokerPolicy

fn clone(&self) -> SecretBrokerPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretBrokerPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecretBrokerPolicy

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecretBrokerPolicy

where SecretBrokerPolicy: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for SecretBrokerPolicy

fn eq(&self, other: &SecretBrokerPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SecretBrokerPolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for SecretBrokerPolicy

impl StructuralPartialEq for SecretBrokerPolicy