Struct SecretRedactor 

pub struct SecretRedactor { /* private fields */ }

Pattern-based redactor. Matches credential-shaped substrings in rendered text and replaces them with [REDACTED:<pattern>] markers. Deliberately a small hand-rolled scanner instead of pulling in regex for this one site — the patterns are simple (prefix-anchored, alnum body) and avoiding the regex compile lets the redactor run in test paths without registering a global LazyLock.

Patterns

Name	Shape
api_key	`(sk
jwt	eyJ + alnum + . + alnum + . + alnum
bearer	Bearer + ≥ 20 alnum/_-. chars
conn_string_credential	://user:password@ segment of a URI

The byte length of every match is recorded in RedactionReport::bytes_redacted so an auditor can tell “redactor fired and removed 1.2 KiB” without seeing the secret.

Implementations

impl SecretRedactor

pub fn new() -> Self

Build the default redactor with the four production patterns.

pub fn redact(&self, input: &str) -> (String, RedactionReport)

Scan input and return (redacted_text, report). Patterns are applied in a fixed order so the report is deterministic.

pub fn scan(&self, input: &str) -> RedactionReport

Scan input and return only the report — useful for the “is this slot allowed to carry a credential?” check before committing to a redaction in an operator-controlled slot.

Trait Implementations

impl Debug for SecretRedactor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecretRedactor

fn default() -> SecretRedactor

Returns the “default value” for a type.