Struct SecretEntry 

#[non_exhaustive]
pub struct SecretEntry {
    pub pattern: String,
    pub kind: String,
    pub category: String,
    pub label: Option<String>,
    pub values: Vec<String>,
    pub min_length: Option<usize>,
    pub max_length: Option<usize>,
    pub threshold: Option<f64>,
    pub charset: Option<String>,
}

A single secret entry as stored in the (plaintext) secrets file.

After decryption the entries are parsed from JSON, YAML, or TOML and converted into ScanPatterns.

Implements Drop via Zeroize to scrub sensitive pattern data from memory when no longer needed (S-1 fix).

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

pattern: String

The pattern string (regex or literal text).

For kind: allow entries this is the single allowlist pattern. Omit when using values instead.

kind: String

"regex", "literal", "allow", "entropy", or "field-name".

"field-name" entries are not compiled into scanner patterns — they are extracted separately and injected into structured-processor profiles as field-name signals. The pattern field is a case-insensitive regex matched against bare field/key names; threshold controls the entropy gate (defaults to 3.5 bits/char when omitted).

category: String

Category string. Supported values: email, name, phone, ipv4, ipv6, credit_card, ssn, hostname, mac_address, container_id, uuid, jwt, auth_token, file_path, windows_sid, url, aws_arn, azure_resource_id, or custom:<tag>.

label: Option<String>

Human-readable label for stats reporting (appears in the redaction summary, findings, and reports). When omitted: a regex pattern defaults to a truncated form of its (non-secret) pattern text; a literal pattern — whose text is the secret value — defaults to literal:<category> so the value is never exposed in reporting output.

values: Vec<String>

Multiple allowlist patterns for kind: allow entries.

When non-empty, used instead of pattern. Allows a single entry to allowlist many values compactly:

[[secrets]]
kind = "allow"
values = ["localhost", "true", "false", "null", "0.0.0.0"]

min_length: Option<usize>

Minimum token length to consider (default: 20).

max_length: Option<usize>

Maximum token length to consider (default: 200).

threshold: Option<f64>

Shannon entropy threshold in bits per character (default: 4.5). Tokens whose entropy is at or above this value are flagged.

charset: Option<String>

Character set the token must consist of exclusively. "alphanumeric" (default), "base64", "hex", or "any".

Implementations

impl SecretEntry

pub fn new( pattern: impl Into<String>, kind: impl Into<String>, category: impl Into<String>, ) -> Self

Create an entry with the given pattern, kind, and category; all other fields take their serde defaults. The struct is #[non_exhaustive], so this (or deserialization) is how entries are built outside the crate.

pub fn with_label(self, label: impl Into<String>) -> Self

Set the reporting label (builder style).

pub fn with_values(self, values: Vec<String>) -> Self

Set the multi-value allowlist patterns (builder style).

pub fn with_length_bounds(self, min: Option<usize>, max: Option<usize>) -> Self

Set the match-length bounds (builder style). Pass None to leave a bound at its default.

pub fn with_threshold(self, threshold: f64) -> Self

Set the entropy threshold (builder style; kind: entropy / kind: field-name entries).

pub fn with_charset(self, charset: impl Into<String>) -> Self

Set the entropy charset (builder style; kind: entropy entries).

Trait Implementations

impl Clone for SecretEntry

fn clone(&self) -> SecretEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretEntry

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Drop for SecretEntry

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl Serialize for SecretEntry

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.