This example demonstrates how to securely handle sensitive (see Security Note) data, such as API keys and passwords, in a Rust application. The setup ensures that sensitive strings are not included in the binary in plaintext and uses encryption to protect secrets during the build process.
- Encryption during Build: The
build.rs
script encrypts thesecrets.toml
file using a predefined key (key
) and saves the result assecrets.toml.encrypted
. - Decryption at Runtime: The main program decrypts the
secrets.toml.encrypted
file at runtime, parses the TOML content, and verifies the data structure. - Static Parsing: The
static_toml
crate provides compile-time validation of the TOML structure. In this experiment, since the same TOML file (though encrypted) is used to build the data structure, deserialization after decryption should not fail unless there is an unexpected issue.