rust-securitylisted

# Rust Security **Attacker paths.** Walk each path from a trust boundary through the caller-controlled input and the enforcement point to an observable denial, and prove the denial. Honor supplied requirements and preserve settled choices outside the requested change; resolve only what the task leaves open. Decide against the existing owners. The hardened chain bounds request bodies, sheds overload, caps handler time, sanitizes panics into an uninformative server error, sets the nosniff header, and accepts an inbound request id only within a strict grammar of at most one hundred twenty-eight safe characters. The bounded server limits header size and header time and caps connections, and closes a client that connects without sending. Cross-origin requests are fail-closed because no CORS layer exists. The config crate keeps secrets out of files, holds them as redacted secret strings, and refuses ambient OpenTelemetry credentials when a typed endpoint selects the collector, so one collector's token never reaches another. Unsafe code is forbidden workspace-wide. Caller-controlled bytes in headers, paths, queries, and bodies are data until an extractor turns them into a typed value; log them only through bounded, allow-listed fields. A caller-provided correlation id is not identity. Missing identity, an ambiguous tenant, or an absent policy denies. A new listener, header, or diagnostic route is an exposure decision: the application listener serves the contract only, the diagnos