Crate secure_errors 

secure_errors — Centralized error handling (OWASP C10).

Provides a three-layer error model:

• Internal layer (kind::AppError): full internal details, never serialized to clients.
• Public layer (public::PublicError): the only type serialized to HTTP responses.
• Operational layer (classify::ErrorClassification): retryability, alerting, signals.

Feature flags

Flag	Default	Enables
axum	✅	middleware::ErrorMappingLayer tower layer + impl IntoResponse for AppError
actix-web		impl actix_web::ResponseError for AppError (see [actix])

Both paths route through the single-source-of-truth mapping in http::into_response_parts, so axum and actix-web responses for the same AppError are byte-identical.

Design invariants

• PublicError is the only type that may be serialized to HTTP responses.
• http::into_response_parts is the only place that maps errors to HTTP status codes.
• No internal error text (SQL, hostnames, stack traces) may appear in PublicError.

Modules

capture

Backtrace capture and context attachment helpers.

classify

Error classification — retryability, alerting, security signals.

context_propagation

Task-local error context propagation.

http

Centralized HTTP mapping — AppError → PublicError + HTTP status.

incident

SecurityIncident trait — sealed to types within the security crate family.

kind

Internal error taxonomy.

middleware

Tower middleware for automatic AppError → HTTP response mapping.

panic

Panic boundary — catches panics at the service boundary and returns a safe 500 response.

public

The public-facing error type serialized into HTTP responses.

report

Internal forensic error report.