NO_RAW_EGRESS

What it says

No HTTP request body is built from data that has not passed through an anonymize, redact or sanitize function.

This wording is for a person to read. What gets verified is the identifier and version — NO_RAW_EGRESS@1 — not the prose. Rewording it does not change what the claim means; changing the meaning requires a new version.

What it does not cover

Every limitation this claim has, in the same type size as the result. The catalog loader refuses to publish a claim that states none.

• Only Rust source can be analyzed today. A subject containing source in any other language is reported not_evaluable rather than passing on the strength of the part that was read.
• Macros are not expanded.
• A sanitizer is recognised by name, and taken at its word. This claim says a function called `redact` was called on the way out; it does not and cannot say that the function redacts anything.
• Request builders are recognised by method name — body, json, form and similar — so a client library with different names is not covered.
• Reading a response is distinguished from sending a request by whether the call was given an argument. A zero-argument call is treated as reading.
• Describes source at a commit, not the binary you run.
• Files excluded by the published skip rules are not examined. Every exclusion is reported in the outcome's coverage, with the rule that caused it.

How it is decided

Evidence required

source_tree

Subject kind

source_tree

Evaluator

privacy-code/no_raw_egress

Determinism

deterministic

Parameters

Part of the claim: two subjects evaluated with different parameters are not comparable.

languages

["rust"]

sanitizers

["anonymize","redact","sanitize"]

Check it yourself

The evaluator is open source and runs offline. Same code, same evidence, same bytes — if it disagrees with what we published, that is a bug and we want to hear about it.

cargo run -p claimer -- check /path/to/project

See the claim standard for the exact formats, or the developer guide to get started.