Criterion measurements for HTML escaping, PII masking, and CSRF token generation. Each applies only when its corresponding rendering or middleware path is used.
escape_str() is called on every dynamic value inside an html! macro block. Clean inputs return Cow::Borrowed (zero allocation). Malicious inputs allocate once.
mask_pii() applies bounded email and payment-card heuristics when the response-masking layer is enabled. It is not complete DLP.
generate_csrf_token() generates the 32-character random value used when CSRF middleware needs a new double-submit cookie.
Website privacy notice ยท Charts load Chart.js from jsDelivr.