Function scrub 

pub fn scrub(text: &str) -> String

Scrub credential leaks from arbitrary text before it crosses into a log record or any other sink. Routes through the global LeakDetector so every known credential shape is redacted in one place rather than via per-callsite regexes. Clean input is returned unchanged.