Struct ShellBleedDetector 

pub struct ShellBleedDetector { /* private fields */ }

Scans shell commands and environment variables for leaked secrets before a shell move lands.

The bleed detector watches for sensitive data escaping into shell commands — API keys, tokens, private keys, and other secrets that should never leave the ring unprotected.

Implementations

impl ShellBleedDetector

pub fn new() -> Self

Create a new bleed detector with built-in patterns for common secret types. Ready to scan from the first bell.

pub fn add_secret_pattern(&mut self, name: &str, pattern: &str)

Add a custom secret pattern to scan for.

The pattern is a regex string. If the regex fails to compile, the pattern is silently ignored (no unwrap — we don’t panic in the ring).

pub fn scan_command(&self, command: &str) -> Vec<ShellBleedWarning>

Scan a shell command string for leaked secrets.

Returns a list of bleed warnings for every pattern that matched. If the command is clean, the vec is empty — no blood on the canvas.

pub fn scan_environment( &self, env_vars: &[(String, String)], ) -> Vec<ShellBleedWarning>

Scan environment variables that would be passed to a subprocess.

Checks both variable names and values for secret patterns — bleed detection covers every angle of the ring.

Trait Implementations

impl Clone for ShellBleedDetector

fn clone(&self) -> ShellBleedDetector

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ShellBleedDetector

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ShellBleedDetector

fn default() -> Self

Returns the “default value” for a type.