Struct SecretEntry 

pub struct SecretEntry {
    pub pattern: String,
    pub kind: String,
    pub category: String,
    pub label: Option<String>,
    pub values: Vec<String>,
    pub min_length: Option<usize>,
    pub max_length: Option<usize>,
    pub threshold: Option<f64>,
    pub charset: Option<String>,
}

A single secret entry as stored in the (plaintext) secrets file.

After decryption the entries are parsed from JSON, YAML, or TOML and converted into ScanPatterns.

Implements Drop via Zeroize to scrub sensitive pattern data from memory when no longer needed (S-1 fix).

Fields

pattern: String

The pattern string (regex or literal text).

For kind: allow entries this is the single allowlist pattern. Omit when using values instead.

kind: String

"regex", "literal", "allow", "entropy", or "field-name".

"field-name" entries are not compiled into scanner patterns — they are extracted separately and injected into structured-processor profiles as field-name signals. The pattern field is a case-insensitive regex matched against bare field/key names; threshold controls the entropy gate (defaults to 3.5 bits/char when omitted).

category: String

Category string. Supported values: email, name, phone, ipv4, ipv6, credit_card, ssn, hostname, mac_address, container_id, uuid, jwt, auth_token, file_path, windows_sid, url, aws_arn, azure_resource_id, or custom:<tag>.

label: Option<String>

Human-readable label for stats reporting (appears in the redaction summary, findings, and reports). When omitted: a regex pattern defaults to a truncated form of its (non-secret) pattern text; a literal pattern — whose text is the secret value — defaults to literal:<category> so the value is never exposed in reporting output.

values: Vec<String>

Multiple allowlist patterns for kind: allow entries.

When non-empty, used instead of pattern. Allows a single entry to allowlist many values compactly:

[[secrets]]
kind = "allow"
values = ["localhost", "true", "false", "null", "0.0.0.0"]

min_length: Option<usize>

Minimum token length to consider (default: 20).

max_length: Option<usize>

Maximum token length to consider (default: 200).

threshold: Option<f64>

Shannon entropy threshold in bits per character (default: 4.5). Tokens whose entropy is at or above this value are flagged.

charset: Option<String>

Character set the token must consist of exclusively. "alphanumeric" (default), "base64", "hex", or "any".

Trait Implementations

impl Clone for SecretEntry

fn clone(&self) -> SecretEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretEntry

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Drop for SecretEntry

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl Serialize for SecretEntry

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.