anyhow

After shipping anyhow in multiple production services, it's become my default for application-level error handling. The `Context` trait is invaluable for adding breadcrumbs as errors bubble up through layers - you get `.context("failed to load config")` on any Result, making debugging production issues dramatically easier. The stack trace capture is opt-in via backtrace feature, so you control the performance implications.

Memory footprint is excellent - errors are single-pointer sized despite carrying context chains. The library has zero dependencies beyond std, so supply chain risk is minimal. Breaking changes have been non-existent since 1.0; I've upgraded across 100+ point releases without touching code. Error downcasting with `.downcast_ref()` works reliably when you need to handle specific error types differently.

One gotcha: anyhow::Error deliberately obscures type information, which is correct for applications but wrong for libraries. The author is clear about this - use thiserror for library crates. The `bail!` and `ensure!` macros feel natural after a day of use and eliminate tons of boilerplate. No configuration needed, no connection pools to manage - it just works.

In production services handling millions of requests, anyhow has proven to be exactly what you need for application-level error handling. The zero-cost ? operator with automatic context chaining means error paths add negligible overhead - I've never seen it show up in profiles. The .context() and .with_context() methods make it trivial to add structured breadcrumbs through your call stack, which is invaluable when debugging production incidents from logs.

The backtrace support integrates cleanly with RUST_BACKTRACE and RUST_LIB_BACKTRACE environment variables, giving you control over verbosity without code changes. Error chain formatting via {:#} is consistent and parseable, making log aggregation straightforward. The library has remained stable across versions - I've upgraded through multiple releases without breaking changes affecting runtime behavior.

One critical distinction: anyhow::Error is for applications, not libraries. For library code that needs typed errors, use thiserror. But for services where you need to propagate errors up to logging/monitoring boundaries, anyhow's trait object approach eliminates boilerplate while preserving full error chains and source information.

Anyhow excels at reducing boilerplate in application-level error handling with its context chaining via `.context()` and `?` operator integration. The ability to attach arbitrary contextual information makes debugging far easier, but this is where security engineers need to pay attention—it's trivially easy to leak sensitive data through error chains if you're not disciplined about what context you attach.

In practice, the type erasure means you lose compile-time guarantees about error variants, which can be problematic for authentication/authorization flows where you need to distinguish between "user not found" vs "wrong password" without exposing that distinction to attackers. The `Debug` formatting includes full backtraces by default when `RUST_BACKTRACE=1`, which is helpful in development but dangerous if errors propagate to API responses or logs without sanitization.

The dependency footprint is minimal (essentially just std), which is excellent from a supply chain perspective. However, the library encourages a pattern where error details accumulate automatically, requiring explicit effort to redact sensitive information rather than being secure-by-default. You need supplementary logic to sanitize errors before they hit boundaries.