Module secret_scan 

Shared secret detection (A195).

Pure scanner used by the engine’s reversible redactor (model boundary) and by the storage layer’s irreversible persistence redaction. It reports byte spans of secrets; callers decide the replacement. Raw values are never logged or retained here.

Structs

SecretSpan

One detected secret: byte range start..end of the scanned text.

Constants

SECRET_PLACEHOLDER_CLOSE

Suffix shared by every redaction placeholder.

SECRET_PLACEHOLDER_OPEN

Prefix shared by every redaction placeholder.

Functions

find_secrets

Find every secret in text, as non-overlapping spans sorted by start.

redact_irreversible

Irreversibly replace every secret with [[CR_SECRET_<KIND>_REDACTED]]. Returns the input unchanged (borrowed) when nothing matched.

redact_json_payload

Redact every string inside a serialized JSON payload (so escaped quotes and newline escapes cannot hide a secret), re-serializing only when something changed. Non-JSON input is redacted as plain text.