Struct Sensitive 

pub struct Sensitive<T: Zeroize>(/* private fields */);

A secret value, redacted in Debug/Display and zeroized on drop.

Never derive or implement Serialize on a type embedding this — that is the point: Sensitive deliberately has no Serialize impl, so a container that tries to derive one over a field of this type fails to compile instead of silently emitting the raw secret.

Deserializing (reading a secret in from TOML/env/CLI) is fine and supported via serde’s Deserialize — only the write-out direction is closed.

Implementations

impl<T: Zeroize> Sensitive<T>

pub const fn new(value: T) -> Self

Wraps value; ordinary Debug/Display no longer print it.

pub const fn expose(&self) -> &T

Returns the wrapped value. The explicit name makes every read site grep-able (rg '\.expose\(') and visibly intentional.

The borrow this returns stays covered by Sensitive’s redaction and zeroize-on-drop, but nothing stops a call site from cloning it out — e.g. handing an owned String to a client that then holds its own untracked, un-zeroized copy for as long as that client lives. The LLM provider configs and constructors hold the key wrapped for their whole lifetime instead (#1277); see the provider crates. The general risk remains for any other call site that reaches for expose and clones the result into a plain, unwrapped copy.

pub const fn expose_secret(&self) -> &T

Alias for Self::expose, matching the secrecy crate’s accessor name for call sites migrating between the two wrappers. Same past-this-point caveat: see Self::expose.

impl Sensitive<String>

pub fn filter_nonempty(opt: Option<&Self>) -> Option<Self>

Treats an empty string as “not configured”.

Config loading routinely needs to turn an optional secret field into None when it’s merely present-but-empty — the wire encoding a shipped manifest’s ConfigMap uses for “unset” — before ever making a request with it. That check has to read the wrapped value, so this is the one sanctioned emptiness peek on a Sensitive<String> outside a request path; every other read site should reach for Self::expose only at the point where the secret is actually used (e.g. an auth header), not to inspect or branch on it ahead of time.

Returns None for None or Some wrapping "", otherwise clones opt’s value into a fresh, independently-owned Some.

Trait Implementations

impl<T: Clone + Zeroize> Clone for Sensitive<T>

fn clone(&self) -> Sensitive<T>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T: Zeroize> Debug for Sensitive<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, T> Deserialize<'de> for Sensitive<T>

where T: Deserialize<'de> + Zeroize,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<T: Zeroize> Display for Sensitive<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T: Zeroize> Drop for Sensitive<T>

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl<T: Zeroize> From<T> for Sensitive<T>

fn from(value: T) -> Self

Converts to this type from the input type.

impl FromStr for Sensitive<String>

fn from_str(s: &str) -> Result<Self, Self::Err>

Wraps the raw string so a clap Args/Parser field declared Sensitive<String> parses straight off the CLI/env value — clap infers a value parser from FromStr for any type that isn’t a ValueEnum.

Deliberately concrete on String rather than a blanket impl<T: FromStr>: a blanket impl registers Sensitive<_> as a FromStr candidate for every open inference variable in every downstream crate, which silently reshapes unrelated .parse() inference (it drove polyc-agent’s env parsing to a LazyLock<String> fallback that no longer type-checked). Every edge wraps a String, so a concrete impl carries the full feature with none of the inference blast radius.

type Err = Infallible

The associated error which can be returned from parsing.