Derive Macro SensitiveDisplay 

#[derive(SensitiveDisplay)]
{
    // Attributes available to this derive:
    #[sensitive]
    #[not_sensitive]
    #[error]
}

Derives redactable::RedactableWithFormatter using a display template.

This generates a redacted string representation without requiring Clone. Unannotated fields use RedactableWithFormatter by default (passthrough for scalars, redacted display for nested SensitiveDisplay types).

Field Annotations

• (none): Uses RedactableWithFormatter (requires the field type to implement it)
• #[sensitive(Policy)]: Apply the policy’s redaction rules
• #[not_sensitive]: Render raw via Display (use for types without RedactableWithFormatter)

The display template is taken from #[error("...")] (thiserror-style) or from doc comments (displaydoc-style). If neither is present, the derive fails.

Fields are redacted by reference, so field types do not need Clone.

When #[sensitive(dual)] is used with a non-generic type, generated code checks that the matching Sensitive derive is also present. Generic dual types cannot be checked at derive time; missing counterparts surface later as trait-bound errors when the type is used.

Generated Impls

• RedactableWithFormatter: always generated.
• ToRedactedOutput: always generated; emits the redacted display text and certifies the type for slog_redacted_display() and tracing_redacted().
• Debug: redacted by default; actual values in the consumer’s cfg(test) builds or when redactable’s testing feature is enabled.
• slog::Value + SlogRedacted: emits the redacted display string (requires slog feature). Skipped when #[sensitive(dual)] is set (Sensitive provides them instead).
• TracingRedacted: marker trait (requires tracing feature). Skipped when #[sensitive(dual)] is set.