Function redact_for_log 

pub fn redact_for_log(value: &str) -> String

Masks the middle of a financial identifier for logging.

Why logging differs from publishing

An IBAN given in front matter is meant to be published — it ends up in the emitted JSON-LD as iso20022:iban, because the author is advertising payment details on purpose. A build log is a different channel: it is captured by CI, retained in artefacts, and read over shoulders. Writing a full account number there is gratuitous, and CodeQL’s rust/cleartext-logging rule is right to flag it.

Enough is kept to act on the warning — the leading country and bank prefix, and the trailing digits — while the account-identifying middle is masked. The reason in the same message already says what is wrong, so the author can find the value in their own front matter without the log restating it.

Short inputs are masked entirely rather than partially: a 6-character value split 4-and-2 would reveal most of itself.

Examples

use ssg::seo::jsonld::iso20022::redact_for_log;
assert_eq!(redact_for_log("GB29NWBK60161331926819"), "GB29…6819");
assert_eq!(redact_for_log("NWBKGB2L"), "………");
assert_eq!(redact_for_log(""), "………");