Found by the security review of #28 (out of that PR's scope: credentials-core).
VaultRecord derives Debug while carrying payload: Vec<u8> (crates/credentials-core/src/record.rs:158-181); AdminOpBody derives Debug around a boxed VaultRecord (crates/credentials-core/src/admin_ops.rs:28-38). No current log site prints them, but OAuthCredential and the CLI's ServedCredential already follow a redacted-Debug convention, and the contract says material must never be exposed by Debug. Same review noted there is no zeroize convention for payload buffers in the CLI paths (the master key is Zeroizing; the material it protects is a plain Vec<u8>).
Proposed: manual redacted Debug for both (payload: [N bytes redacted]), and Zeroizing<Vec<u8>> for material buffers where the type crosses a function boundary. Happy to PR it after #28 settles if you want it.
Found by the security review of #28 (out of that PR's scope: credentials-core).
VaultRecordderivesDebugwhile carryingpayload: Vec<u8>(crates/credentials-core/src/record.rs:158-181);AdminOpBodyderivesDebugaround a boxedVaultRecord(crates/credentials-core/src/admin_ops.rs:28-38). No current log site prints them, butOAuthCredentialand the CLI'sServedCredentialalready follow a redacted-Debug convention, and the contract says material must never be exposed by Debug. Same review noted there is no zeroize convention for payload buffers in the CLI paths (the master key isZeroizing; the material it protects is a plainVec<u8>).Proposed: manual redacted
Debugfor both (payload: [N bytes redacted]), andZeroizing<Vec<u8>>for material buffers where the type crosses a function boundary. Happy to PR it after #28 settles if you want it.