SecretString

An inline value class that wraps a sensitive string, ensuring it is never accidentally leaked through toString, logging, or string interpolation.

Safety guarantees:

• toString always returns "********" -- the plaintext is never exposed.

• The only way to obtain the underlying value is by calling expose explicitly, making accidental leaks easy to spot in code review.

• Because this is an inline value class, there is zero runtime allocation overhead compared to a raw String.

Example:

val apiKey = SecretString("sk-live-abc123")

println(apiKey)            // prints: ********
println("Key=$apiKey")     // prints: Key=********
println(apiKey.expose())   // prints: sk-live-abc123  (intentional access)

Fields of type SecretString are automatically detected by SecretExtractor and masked with club.skidware.kconfig.annotation.MaskStrategy.FULL even without a @Secret annotation.

See also