//! `tracing` field filter that drops sensitive field names before they reach the subscriber.
//!
//! Hosts install this as a `tracing_subscriber::Layer`. The Rust core never logs secrets in
//! the first place; this is defense-in-depth for accidental future regressions.

pub const REDACTED_FIELDS: &[&str] = &[
    "key",
    "secret",
    "seed",
    "payload",
    "plaintext",
    "private_key",
    "signing_key",
    "init_key",
    "ciphertext", // ciphertext can be linked to plaintext via timing
];

pub fn is_sensitive(field_name: &str) -> bool {
    REDACTED_FIELDS.iter().any(|s| field_name.contains(s))
}
