Module redaction 

secret_redaction (canonical transform id: "secret_redaction"): a mandatory safety preprocessor that scans text for common enterprise secret shapes (JWTs, API keys, AWS access key IDs, basic-auth-in-URL credentials, and bearer tokens) and replaces each match with a fixed marker naming which kind of secret was found, without ever echoing the secret’s actual value back into the output.

This module implements only the pure scan-and-replace behavior. The policy wiring that makes secret_redaction non-disableable lives elsewhere (see CompressionPolicyBuilder in budget.rs).

All patterns run on Rust’s regex crate, whose matching engine is provably linear-time in the length of the input (no backtracking), which is why it is the only regex engine permitted in this file’s problem space — see deny.toml at the workspace root.

Structs

RedactionOutcome

Result of running redact over a byte buffer.

Functions

contains_secret

Cheaply tests whether any known secret pattern matches input, without allocating a redacted copy. Used by retrieval_store to gate what may ever be persisted: nothing that would be redacted by redact is eligible for storage.

redact

Scans input (treated as best-effort UTF-8 via lossy conversion) for known secret shapes and replaces each match with a marker identifying the kind of secret found. Returns the redacted bytes plus a count of total replacements made.