Derive Macro Sensitive 

#[derive(Sensitive)]
{
    // Attributes available to this derive:
    #[sensitive]
    #[not_sensitive]
    #[redactable]
}

Derives redactable::RedactableWithMapper (and related impls) for structs and enums.

Container Attributes

These attributes are placed on the struct/enum itself:

Sensitive and SensitiveDisplay are standalone derives. Use SensitiveDual when a type needs both structural and display redaction.

Use #[redactable(recursive)] on a field whose crate-qualified, aliased, or mutually recursive type would otherwise create a self-referential inferred bound. Unannotated fields retain their exact complete-type bounds. #[redactable(legacy_formatting)] and #[redactable(generated_formatting)] are display-only formatting options; standalone Sensitive rejects both. Apply them on SensitiveDisplay or SensitiveDual (which is what to use when a type needs structural and display redaction together); those derives document what each option selects.

Field Attributes

• No annotation: The field requires declared Redactable behavior and is traversed with the supplied mapper. Raw leaves need a policy or an explicit public declaration.

• #[sensitive(Secret)]: For scalar types (i32, bool, char, etc.), redacts to default values (0, false, ‘*’). For string-like types, applies full redaction to "[REDACTED]".

• #[sensitive(Policy)]: Applies the policy’s redaction rules to string-like values. Works for String, Option<String>, Vec<String>, Box<String>. Scalars can only use #[sensitive(Secret)].

• #[not_sensitive]: Explicit passthrough - the field is not transformed at all. Use this for foreign types that don’t implement RedactableWithMapper. This is the right declaration for a foreign field in a struct you own; BypassRedaction<T> is only for satisfying a Redactable bound on a value you cannot annotate.

Unions are rejected at compile time.

Generated Impls

• ToRedacted: always generated. It clones, redacts and serializes, producing a RedactedValue that carries redacted JSON. This is why Sensitive requires Clone and serde::Serialize on the type; a missing bound is reported on the generated impl.
• RedactableWithMapper: always generated.
• Redactable: always generated. Provides .redact() and certifies the type for SlogRedactedExt.
• Debug: uses the production redacted representation in every build mode.
• slog::Value + SlogRedacted (requires slog feature): borrowed generated output is a fixed fail-closed placeholder and never clones or serializes the raw reference. Owned values can use SlogRedactedExt::slog_redacted_json for redact-then-serialize structured output.
• TracingRedacted (requires tracing feature): marker trait.