Function redact_secrets 

pub fn redact_secrets(input: &str) -> String

Strip known-sensitive patterns from the input string.

Replaces known secret patterns (API keys, tokens, JWTs, password= pairs, PEM private keys) with [REDACTED], and masks credentials embedded in URL userinfo (scheme://user:pass@host becomes scheme://***@host). This is a safe-default measure to ensure secrets do not leak into logs, error messages, or temp files. The operation is idempotent.

Examples

use santh_error::redact_secrets;

let raw = "password=hunter2";
let safe = redact_secrets(raw);
assert!(!safe.contains("hunter2"));
assert!(safe.contains("[REDACTED]"));

// URL credentials are masked while the scheme and host survive.
let url = redact_secrets("https://admin:s3cret@example.com/path");
assert!(!url.contains("s3cret"));
assert!(url.contains("https://***@example.com/path"));