Function redact_for_log 

pub fn redact_for_log(value: &str) -> String

Validates an IBAN (ISO 13616) using the MOD-97 checksum.

Accepts the canonical compact form (no spaces) as well as the space-delimited print form. Length bounds: 15–34 characters once whitespace is stripped.

Algorithm

1. Strip all ASCII whitespace; upper-case.
2. Move the first 4 characters (country + check digits) to the end.
3. Map letters A-Z → 10..=35.
4. The resulting integer must be congruent to 1 mod 97.

Implemented without num-bigint by walking the digit string left to right, taking each modulo step incrementally — this keeps the Masks the middle of a financial identifier for logging.

Why logging differs from publishing

An IBAN given in front matter is meant to be published — it ends up in the emitted JSON-LD as iso20022:iban, because the author is advertising payment details on purpose. A build log is a different channel: it is captured by CI, retained in artefacts, and read over shoulders. Writing a full account number there is gratuitous, and CodeQL’s rust/cleartext-logging rule is right to flag it.

Enough is kept to act on the warning — the leading country and bank prefix, and the trailing digits — while the account-identifying middle is masked. The reason in the same message already says what is wrong, so the author can find the value in their own front matter without the log restating it.

Short inputs are masked entirely rather than partially: a 6-character value split 4-and-2 would reveal most of itself.

Examples

use ssg::seo::jsonld::iso20022::redact_for_log;
assert_eq!(redact_for_log("GB29NWBK60161331926819"), "GB29…6819");
assert_eq!(redact_for_log("NWBKGB2L"), "………");
assert_eq!(redact_for_log(""), "………");