rust-security

Applies CipherStash company rules for Rust code that handles secrets, cryptography, and authentication — the crate-level security lint block, opaque secret types with no AsRef or Deref, crypto library order (vitaminc, then aws-lc-rs, then RustCrypto), one encryption context per purpose, udigest for structured hashes, opaque errors at crypto and HTTP boundaries, JWT verification, constant-time encoding, and logging discipline. Defers vitaminc types and APIs (Protected, Equatable, AEAD, PRF, SafeRand) to the vitaminc skill or docs.rs. Use when writing or changing Rust code that encrypts or decrypts, derives or stores keys, defines a token, key, password, or other secret type, compares or hashes secret values, generates security-relevant randomness, verifies credentials or JWTs, or serializes or logs data that may contain secrets. Does not apply to Rust code with no secret or crypto handling, non-Rust code, or general public API design, which rust-sdk-dx owns.