Skip to content
Benchmarks

redact-secret · Evaluation

Qualification from the official runs

The support status the adapter derived from one official evaluation run per population. It is built beside the existing report, which stays the reference until cutover.

  • Publication public
  • Policy revision rs-policy-1:sha256:94c247cf72ea

Read this before the numbers

The evaluation engine measures and records; it emits no support status. The status shown here is this benchmark’s own qualification of the product, derived from the engine’s results by the adapter. A scanner’s observation is shown on its own and carries no status.

Every count carries its population. No figure is a sum across populations or scanners, and a gate that did not run is shown as not measured, never as zero.

Maintainer-reviewed (independent review pending)

598 fixtures of the 7,041 in evidence release snapshot-2026.10.06.4 carry this label. They are counted in the numbers on this page.

Passed the project’s own verification (source evidence, automated checks, recorded counter-arguments); not yet independently reviewed.

Support status of the detector families

One count per recorded status, over the families the product qualification scores.

Published release · redact-secret 0.1.0-beta.14 · public view

Stable

116

Every stable floor holds in this view.

Provisional

29

A detector exists and a floor, or a required method, does not hold yet.

Pending

1

No positive fixture has cleared review.

Unsupported

0

Recorded as unsupported.

Stable by documented route

83

Provider-documented format.

Stable by empirical route

33

Corroborated: checked against other tools and community sources; the comparison is run by this project.

Stable by policy-qualified route

0

Project policy with a protected holdout.

Identity of this view

View schema
redact-secret/qualification-view/v1
Adapter
credential-eval-run-artifact v1
Product policy revision
rs-policy-1:sha256:94c247cf72ea74fa1f226af3392764e58a3bf64ad7af5056c3d68926a844f0da
Methods the policy requires
metamorphic, mutation, differential
Policy inputs
11 benchmark-owned files and tables, each digested in the revision
Source file
public/results/qualification-v1.json

Populations

Each population is its own run with its own denominator, evidence and run identity. Counts are never added together.
Populations
PopulationRun classEvidenceCorpus digestEngineConfiguration hashSemantic digestMethods runCases
policy-corpuspolicy routepublicredact-secret-benchmarks/policy · policy-37293aba657dsha256:37293aba657dcredential-eval 0.1.0-alpha.16 · credential-eval-protocol/1sha256:660d8f90a0a0sha256:47854ffdc5d0None run19
public-evidence-snapshotfloors and gatespubliccredential-evidence · snapshot-2026.10.06.4sha256:2319e44084d4credential-eval 0.1.0-alpha.16 · credential-eval-protocol/1sha256:660d8f90a0a0sha256:4bec6e539482None run7,036
regression-corpusgatespublicredact-secret-benchmarks/regression · regression-b7b236c5ad1asha256:b7b236c5ad1acredential-eval 0.1.0-alpha.16 · credential-eval-protocol/1sha256:660d8f90a0a0sha256:afedeab625b5None run153

Scanners

The scanners each population ran with, as the run artifact recorded them.
Scanners
PopulationScannerVersionBuildMode line of the run
policy-corpusflare-redact1.6.1releasedPublished npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engine
policy-corpusgitleaks8.30.1releasedDirectory scan · default rules
policy-corpusredact-secret0.1.0-beta.14releasedPublished npm package · default detectors
policy-corpustrufflehog3.97.4releasedFilesystem scan · verification disabled
public-evidence-snapshotflare-redact1.6.1releasedPublished npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engine
public-evidence-snapshotgitleaks8.30.1releasedDirectory scan · default rules
public-evidence-snapshotredact-secret0.1.0-beta.14releasedPublished npm package · default detectors
public-evidence-snapshottrufflehog3.97.4releasedFilesystem scan · verification disabled
regression-corpusflare-redact1.6.1releasedPublished npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engine
regression-corpusgitleaks8.30.1releasedDirectory scan · default rules
regression-corpusredact-secret0.1.0-beta.14releasedPublished npm package · default detectors
regression-corpustrufflehog3.97.4releasedFilesystem scan · verification disabled

The same package runs under two configurations. Each is its own scanner with its own results and history; they are never added together or spliced.

Profiles of one scanner
ProfileScanner idWhat it detectsConfiguration identityIn this view
OpenRedaction default (all patterns)openredactionEvery built-in OpenRedaction pattern (579 in 1.1.5): credentials and also personal data (names, phone numbers, handles) and resource identifiers. Most of its findings are out of scope for credential evaluation.Every built-in pattern; its history is labelled with each run, engine, configuration and dateNot measured in this view
OpenRedaction credential profile (33 types)openredaction-credential-bearingOnly the 33 credential-bearing OpenRedaction pattern types (the credentials category plus URL_WITH_AUTH): API keys and tokens, private keys, connection strings, session identifiers. No personal-data or resource-identifier pattern runs, so it cannot flag or accidentally overlap them.openredaction-credential-bearing adapter 1 · @openredaction/core 1.1.5 · 33 types · configuration sha256:cf4b7c9a535fNot measured in this view

Results differ by configuration

Both are OpenRedaction 1.1.5 under different configurations. The profile scans less, so its results differ from the default's by configuration: it is not a more accurate OpenRedaction, and no accuracy claim is made for either profile.

OpenRedaction default (all patterns): not measured in this run (optional)

The default (all-pattern) profile is slow and noisy for credential evaluation: personal data and resource identifiers dominate its findings, and its last official measurement took 7 minutes of scanner time on a population the credential profile scans in seconds (its methods run takes 40+ minutes), so it is a manual measurement and never blocks other scanners or core verification (#763). Its earlier results stay as history with their run identity; the credential profile is a separate scanner, never spliced with it.

Last measurement: policy-corpus@linux-x64 (configuration sha256:2451ce7bf380), public-evidence-snapshot+methods@linux-x64 (configuration sha256:d47d081ce5fb), public-evidence-snapshot@linux-x64 (configuration sha256:2451ce7bf380), regression-corpus@linux-x64 (configuration sha256:2451ce7bf380) · engine 0.1.0-alpha.5 · recorded 2026-10-05 · retained record, no longer listed by the run registry. It stays labelled with that run identity and is never combined with another profile or another run.

Its artifacts are kept in the archive release official-runs-registry-37296823599 (asset official-runs-37296823599.tar.gz, CI run 37296823599); the roster records each run’s artifact digest.

Scope accounting in that measurement: the engine of that run did not record native labels (legacy: native labels unavailable), so every scope count for it is Unknown, never zero, and nothing is classified retrospectively.

OpenRedaction credential profile (33 types): not measured in an official run (local exploratory diagnostics only: see ADR)

The credential profile is the comparison profile chosen in docs/decisions/2026-10-06-choose-the-openredaction-credential-bearing-profile-as-the-comparison-scanner.md. It is optional in the official run class because no pinned engine configuration measures it yet: making it required would refuse every official view until the owner approves the one profile-only run. Its own history starts with that run; nothing of the default's is reused for it.

No earlier measurement of it is recorded. Nothing is shown in its place.

Official measurement: pending: requires owner approval (one profile-only run; see the decision).

Findings by scope

What the engine recorded for the findings each scanner produced, per population and per artifact. A different count here is not a different accuracy.

Published release · redact-secret 0.1.0-beta.14 · public view

How to read these counts

Native type (what the scanner said), derived family (the adapter’s classification) and reviewed scope (the engine’s table, with its reason) are separate. An unmapped finding is neither a false positive nor ignored, and a type reviewed as not a credential is shown as an out-of-scope diagnostic, not a credential detection.

Unknown means no accounting was recorded for that artifact (an older engine, a scanner with no reviewed table, or a scanner that did not complete). It is not zero. Each artifact is accounted apart; nothing is added across populations, scanners or the plain and methods runs.

A credential profile is a separate scanner configuration with its own identity, shown beside the default and never in its place. No finding is removed from any score, and no evidence denominator shrinks.

Findings by scope
ScannerConfigurationClassification versionStateNative-label coverageMapped credentialsCredential-related, unmappedOut of scope (personal data, resource identifiers)AmbiguousNative label unavailableUnrecognized labelNative typesLimits
flare-redactpolicy-corpus · plain runDefault configurationconfig sha256:f111f4606c91 · adapter 1 · 1.6.1engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
gitleakspolicy-corpus · plain runDefault configurationconfig sha256:f091a51ed948 · adapter 2 · 8.30.1engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
redact-secretpolicy-corpus · plain runConfiguration not declaredconfig sha256:e8d78f1359d1 · adapter 3 · 0.1.0-beta.14engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
trufflehogpolicy-corpus · plain runDefault configurationconfig sha256:d077d8241c93 · adapter 2 · 3.97.4engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
flare-redactpublic-evidence-snapshot · plain runDefault configurationconfig sha256:f111f4606c91 · adapter 1 · 1.6.1engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
gitleakspublic-evidence-snapshot · plain runDefault configurationconfig sha256:f091a51ed948 · adapter 2 · 8.30.1engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
redact-secretpublic-evidence-snapshot · plain runConfiguration not declaredconfig sha256:e8d78f1359d1 · adapter 3 · 0.1.0-beta.14engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
trufflehogpublic-evidence-snapshot · plain runDefault configurationconfig sha256:d077d8241c93 · adapter 2 · 3.97.4engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
flare-redactpublic-evidence-snapshot · methods runDefault configurationconfig sha256:f111f4606c91 · adapter 1 · 1.6.1engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
gitleakspublic-evidence-snapshot · methods runDefault configurationconfig sha256:f091a51ed948 · adapter 2 · 8.30.1engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
redact-secretpublic-evidence-snapshot · methods runConfiguration not declaredconfig sha256:e8d78f1359d1 · adapter 3 · 0.1.0-beta.14engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
trufflehogpublic-evidence-snapshot · methods runDefault configurationconfig sha256:d077d8241c93 · adapter 2 · 3.97.4engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
flare-redactregression-corpus · plain runDefault configurationconfig sha256:f111f4606c91 · adapter 1 · 1.6.1engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
gitleaksregression-corpus · plain runDefault configurationconfig sha256:f091a51ed948 · adapter 2 · 8.30.1engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
redact-secretregression-corpus · plain runConfiguration not declaredconfig sha256:e8d78f1359d1 · adapter 3 · 0.1.0-beta.14engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.
trufflehogregression-corpus · plain runDefault configurationconfig sha256:d077d8241c93 · adapter 2 · 3.97.4engine 0.1.0-alpha.16 · no classification recordedNot accountedUnknownUnknownUnknownUnknownUnknownUnknownUnknownNone
2 stated
  • The artifact carries no scope accounting: the engine has no reviewed disposition table for this scanner, or its version is not one this reader knows. Unmapped findings are unknown, not zero.
  • Counts describe the findings the artifact retains. No finding was removed, relabelled or excluded, and no case outcome, denominator or floor depends on them.

Credential profiles against the default

A declared profile and its default scanner measured on the same population, as separate observations. The difference is a recorded configuration effect, not a speed-up and not a change of any outcome.

Credential profiles against the default
Profile against defaultConfiguration identitiesChange in positive span outcomesChange in benign controls flaggedChange in retained findingsEvidence denominators
No declared profile was measured on the same population as its default scanner.

Where each observation came from

Whether each scanner was scanned in the run or its observation was taken from an earlier verified run, per population and per artifact. Provenance, shown apart from the scope evidence above.

How to read the origin

Origin is read from the artifact’s non-semantic telemetry. That telemetry is excluded from the semantic digest on purpose, so a run that reused an observation and a run that scanned it fresh have the same semantic digest. It changes no count, outcome, denominator, floor or status.

Not recorded is what the artifact says when the run offered no observations for reuse, and for every artifact of an older engine. It is not read as scanned in this run. The official driver refuses reuse, and an artifact is shown as it records itself.

A scanner the run did not measure has no observation and so no origin; it is stated as not measured below, never as scanned or reused.

Where each observation came from
ScannerOrigin of the observationReason the engine gaveReceipt
flare-redactpolicy-corpus · plain runNot recordedNone recordedNone recorded
gitleakspolicy-corpus · plain runNot recordedNone recordedNone recorded
redact-secretpolicy-corpus · plain runNot recordedNone recordedNone recorded
trufflehogpolicy-corpus · plain runNot recordedNone recordedNone recorded
flare-redactpublic-evidence-snapshot · plain runNot recordedNone recordedNone recorded
gitleakspublic-evidence-snapshot · plain runNot recordedNone recordedNone recorded
redact-secretpublic-evidence-snapshot · plain runNot recordedNone recordedNone recorded
trufflehogpublic-evidence-snapshot · plain runNot recordedNone recordedNone recorded
flare-redactpublic-evidence-snapshot · methods runNot recordedNone recordedNone recorded
gitleakspublic-evidence-snapshot · methods runNot recordedNone recordedNone recorded
redact-secretpublic-evidence-snapshot · methods runNot recordedNone recordedNone recorded
trufflehogpublic-evidence-snapshot · methods runNot recordedNone recordedNone recorded
flare-redactregression-corpus · plain runNot recordedNone recordedNone recorded
gitleaksregression-corpus · plain runNot recordedNone recordedNone recorded
redact-secretregression-corpus · plain runNot recordedNone recordedNone recorded
trufflehogregression-corpus · plain runNot recordedNone recordedNone recorded
  • OpenRedaction default (all patterns): not measured in this run (optional). It has no observation in this view, so no origin.
  • OpenRedaction credential profile (33 types): not measured in an official run (local exploratory diagnostics only: see ADR). It has no observation in this view, so no origin.

Detector families

One row per family the product qualification scores. Open one for its evidence and what each scanner recorded.
Detector families
Detector familySupport statusRouteEvidence tierEvidence basisHeld below stable byCases per population (redact-secret)
ai21-api-keyai21StableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 60
  • regression-corpus 0
anthropic-admin01-keyanthropicProvisionalNo routeT1provider-documentedmutation.unresolvedCritical
  • policy-corpus 0
  • public-evidence-snapshot 39
  • regression-corpus 4
anthropic-api01-keyanthropicProvisionalNo routeT1provider-documentedmutation.unresolvedCritical
  • policy-corpus 0
  • public-evidence-snapshot 37
  • regression-corpus 4
anthropic-tokenanthropicStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 30
  • regression-corpus 0
apify-api-tokenapifyStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 38
  • regression-corpus 0
atlassian-api-tokenatlassianStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 45
  • regression-corpus 0
aws-access-keyawsStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 31
  • regression-corpus 3
aws-bedrock-long-term-api-keyaws-bedrockStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 44
  • regression-corpus 0
aws-bedrock-short-term-api-keyaws-bedrockStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 34
  • regression-corpus 0
aws-secret-access-keyawsProvisionalNo routeT2corroboratedmetamorphic.criticalFailuresmutation.unresolvedCriticaldifferential.unresolvedContractDisagreements
  • policy-corpus 0
  • public-evidence-snapshot 64
  • regression-corpus 0
axiom-personal-tokenaxiomStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 25
  • regression-corpus 0
axiom-tokenaxiomStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 37
  • regression-corpus 0
azure-devops-personal-access-tokenazure-devopsStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 29
  • regression-corpus 0
baseten-api-keybasetenProvisionalNo routeT3project-policyqualificationProfilebenign.minimumCasesbenign.minimumAxes
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0
bearer-tokenNo providerProvisionalNo routeT3project-policypolicy.positive-casespolicy.positive-axespolicy.benign-cases7 more
  • policy-corpus 4
  • public-evidence-snapshot 52
  • regression-corpus 3
bitwarden-secrets-manager-access-tokenbitwardenStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 46
  • regression-corpus 0
browserbase-api-keybrowserbaseStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 38
  • regression-corpus 0
buildkite-tokenbuildkiteProvisionalNo routeT1provider-documenteddocumented.minimumPositiveCasesdocumented.minimumPositiveAxesdocumented.minimumBenignCases4 more
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0
cerebras-api-keycerebrasStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 46
  • regression-corpus 0
clickhouse-cloud-api-secretclickhouse-cloudStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 45
  • regression-corpus 0
clojars-deploy-tokenclojarsStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 37
  • regression-corpus 0
cloudflare-tokencloudflareStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 24
  • regression-corpus 0
cohere-api-keycohereStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 78
  • regression-corpus 0
composio-api-keycomposioStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 48
  • regression-corpus 0
composio-org-api-keycomposioStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
composio-user-api-keycomposioStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
confluent-cloud-api-secretconfluentStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 31
  • regression-corpus 0
confluent-cloud-api-secret-legacyconfluentStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 60
  • regression-corpus 0
connection-stringNo providerProvisionalNo routeT3project-policypolicy.positive-casespolicy.positive-axespolicy.benign-cases5 more
  • policy-corpus 4
  • public-evidence-snapshot 104
  • regression-corpus 22
convex-deployment-keyconvexStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 41
  • regression-corpus 0
crates-io-tokencrates-ioStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 37
  • regression-corpus 0
crates-io-trusted-publishing-tokencrates-ioStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 29
  • regression-corpus 0
databricks-personal-access-tokendatabricksStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 47
  • regression-corpus 0
datadog-api-keydatadogStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
datadog-application-keydatadogStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 29
  • regression-corpus 0
datadog-application-key-legacydatadogStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 52
  • regression-corpus 0
daytona-api-keydaytonaStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 44
  • regression-corpus 0
deepgram-api-keydeepgramStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 82
  • regression-corpus 0
digitalocean-tokendigitaloceanStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 39
  • regression-corpus 0
discord-bot-tokendiscordStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 46
  • regression-corpus 0
docker-tokendockerStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
doppler-audit-tokendopplerStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
doppler-cli-tokendopplerStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
doppler-personal-tokendopplerStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
doppler-scim-tokendopplerStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
doppler-service-account-identity-tokendopplerStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
doppler-service-account-tokendopplerStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 37
  • regression-corpus 0
doppler-tokendopplerStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 51
  • regression-corpus 0
dynatrace-tokendynatraceStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 41
  • regression-corpus 0
e2b-api-keye2bStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 43
  • regression-corpus 0
elevenlabs-api-keyelevenlabsStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 38
  • regression-corpus 4
firebase-server-keyfirebaseStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 45
  • regression-corpus 0
firecrawl-api-keyfirecrawlStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 48
  • regression-corpus 0
fireworks-ai-api-keyfireworks-aiStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 32
  • regression-corpus 0
fly-tokenflyProvisionalNo routeT1provider-documenteddocumented.minimumPositiveCasesdocumented.minimumPositiveAxesdocumented.minimumBenignCases4 more
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0
generic-tokenNo providerProvisionalNo routeT3project-policypolicy.positive-casespolicy.positive-axespolicy.benign-cases8 more
  • policy-corpus 4
  • public-evidence-snapshot 237
  • regression-corpus 70
github-fine-grained-patgithubStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
github-tokengithubProvisionalNo routeT1provider-documenteddifferential.unresolvedContractDisagreements
  • policy-corpus 0
  • public-evidence-snapshot 201
  • regression-corpus 0
gitlab-runner-authentication-tokengitlabStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 43
  • regression-corpus 0
gitlab-tokengitlabStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 57
  • regression-corpus 0
google-api-keygoogleStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 32
  • regression-corpus 0
google-oauth-client-secretgoogleStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
grafana-cloud-access-policy-tokengrafanaStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
grafana-service-account-tokengrafanaStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
groq-api-keygroqStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 41
  • regression-corpus 0
helicone-api-keyheliconeStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 45
  • regression-corpus 0
helicone-write-api-keyheliconeStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
heroku-api-keyherokuStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 29
  • regression-corpus 0
heroku-api-key-legacyherokuStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 63
  • regression-corpus 0
honeycomb-api-keyhoneycombStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 39
  • regression-corpus 0
huggingface-tokenhuggingfaceStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 26
  • regression-corpus 0
inngest-signing-keyinngestStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
jwtNo providerStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 26
  • regression-corpus 0
langfuse-secret-keylangfuseStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 42
  • regression-corpus 0
langsmith-api-keylangsmithStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 42
  • regression-corpus 0
linear-tokenlinearStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 27
  • regression-corpus 0
mailchimp-api-keymailchimpStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 54
  • regression-corpus 0
mailgun-api-keymailgunStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 43
  • regression-corpus 0
mapbox-tokenmapboxProvisionalNo routeT1provider-documenteddocumented.minimumPositiveCasesdocumented.minimumPositiveAxesdocumented.minimumBenignCases4 more
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0
microsoft-entra-client-secretmicrosoft-entraStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 45
  • regression-corpus 0
mistral-api-keymistralStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 68
  • regression-corpus 0
neon-api-keyneonStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 42
  • regression-corpus 0
netlify-tokennetlifyStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 24
  • regression-corpus 0
new-relic-license-keynew-relicStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 42
  • regression-corpus 0
new-relic-user-api-keynew-relicStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
notion-tokennotionStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 29
  • regression-corpus 0
npm-tokennpmStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 55
  • regression-corpus 0
nvidia-api-keynvidiaStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 39
  • regression-corpus 0
okta-api-tokenoktaProvisionalNo routeT2corroboratedempirical.unresolvedContradictions
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
onepassword-service-account-tokenonepasswordStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 39
  • regression-corpus 0
openai-admin-api-keyopenaiStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 43
  • regression-corpus 0
openai-tokenopenaiStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 47
  • regression-corpus 0
openrouter-api-keyopenrouterStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 32
  • regression-corpus 0
ory-tokenoryProvisionalNo routeT3project-policyqualificationProfilebenign.minimumCasesbenign.minimumAxes
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0
otpauth-uriNo providerProvisionalNo routeT3project-policypolicy.positive-casespolicy.positive-axespolicy.benign-cases3 more
  • policy-corpus 7
  • public-evidence-snapshot 24
  • regression-corpus 0
paddle-api-keypaddleStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 41
  • regression-corpus 0
perplexity-api-keyperplexityStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 41
  • regression-corpus 0
pinecone-api-keypineconeStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 43
  • regression-corpus 0
polar-api-credentialpolarProvisionalNo routeT1provider-documenteddocumented.minimumBenignCasesdocumented.minimumTwinPairs
  • policy-corpus 0
  • public-evidence-snapshot 28
  • regression-corpus 0
polar-tokenpolarProvisionalNo routeT1provider-documenteddocumented.minimumTwinPairs
  • policy-corpus 0
  • public-evidence-snapshot 38
  • regression-corpus 0
posthog-project-secret-api-keyposthogStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
posthog-tokenposthogStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 44
  • regression-corpus 0
postman-api-keypostmanStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 46
  • regression-corpus 0
postman-collection-access-keypostmanStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 42
  • regression-corpus 0
private-keyNo providerStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
pulumi-access-tokenpulumiStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 26
  • regression-corpus 0
pydantic-logfire-tokenpydanticProvisionalNo routeT1provider-documenteddocumented.minimumPositiveCasesdocumented.minimumPositiveAxesdocumented.minimumBenignCases4 more
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0
pypi-tokenpypiStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 26
  • regression-corpus 0
replicate-api-tokenreplicateStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 32
  • regression-corpus 0
resend-api-keyresendStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 42
  • regression-corpus 0
rubygems-api-keyrubygemsStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 39
  • regression-corpus 0
runpod-api-keyrunpodStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 36
  • regression-corpus 0
sendgrid-tokensendgridProvisionalNo routeT1provider-documentedmetamorphic.criticalFailuresmutation.unresolvedCriticaldifferential.unresolvedContractDisagreements
  • policy-corpus 0
  • public-evidence-snapshot 167
  • regression-corpus 49
sentry-org-auth-tokensentryStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
sentry-user-auth-tokensentryStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
shopify-tokenshopifyStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 27
  • regression-corpus 0
slack-app-level-tokenslackProvisionalNo routeT2corroboratedempirical.corroborated.minimumReferencesempirical.corroborated.minimumOwnersempirical.corroborated.minimumClasses7 more
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
slack-tokenslackStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 47
  • regression-corpus 0
slack-user-tokenslackStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 27
  • regression-corpus 0
sonarqube-analysis-tokensonarqubeStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 28
  • regression-corpus 0
sonarqube-tokensonarqubeStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
sourcegraph-tokensourcegraphProvisionalNo routeT1provider-documenteddocumented.minimumPositiveCasesdocumented.minimumPositiveAxesdocumented.minimumBenignCases4 more
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0
square-oauth-application-secretsquareProvisionalNo routeT1provider-documenteddocumented.minimumPositiveCasesdocumented.minimumPositiveAxesdocumented.minimumBenignCases4 more
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0
square-tokensquareProvisionalNo routeT1provider-documenteddocumented.minimumPositiveCasesdocumented.minimumPositiveAxesdocumented.minimumBenignCases4 more
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0
stripe-tokenstripeStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 136
  • regression-corpus 0
stripe-webhook-signing-secretstripeStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 29
  • regression-corpus 0
supabase-management-tokensupabaseStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 26
  • regression-corpus 0
supabase-tokensupabaseStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 30
  • regression-corpus 0
tavily-api-keytavilyStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 45
  • regression-corpus 0
telegram-bot-tokentelegramStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
terraform-cloud-tokenhashicorp-terraformStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 26
  • regression-corpus 0
together-ai-api-keytogetherProvisionalNo routeT2corroboratedempirical.corroborated.minimumClassesempirical.minimumObservationsempirical.minimumSubjects2 more
  • policy-corpus 0
  • public-evidence-snapshot 56
  • regression-corpus 0
travisci-api-tokentravis-ciStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 48
  • regression-corpus 0
trigger-dev-personal-access-tokentrigger-devStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 28
  • regression-corpus 0
trigger-dev-tokentrigger-devStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 50
  • regression-corpus 0
twilio-api-key-secrettwilioProvisionalNo routeT2corroborateddifferential.unresolvedContractDisagreements
  • policy-corpus 0
  • public-evidence-snapshot 50
  • regression-corpus 0
twilio-auth-tokentwilioStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 64
  • regression-corpus 0
unkey-root-keyunkeyProvisionalNo routeT1provider-documenteddocumented.minimumPositiveCasesdocumented.minimumPositiveAxesdocumented.minimumBenignCases4 more
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0
vault-tokenhashicorp-vaultStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 28
  • regression-corpus 0
vercel-app-access-tokenvercelProvisionalNo routeT2corroboratedempirical.minimumTwinPairstwinFailuresmutation.unresolvedCritical1 more
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
vercel-app-refresh-tokenvercelProvisionalNo routeT2corroboratedempirical.minimumTwinPairstwinFailuresmutation.unresolvedCritical1 more
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
vercel-personal-access-tokenvercelProvisionalNo routeT2corroboratedempirical.minimumTwinPairstwinFailuresmutation.unresolvedCritical1 more
  • policy-corpus 0
  • public-evidence-snapshot 40
  • regression-corpus 0
vercel-tokenvercelPendingNo routeT0nonepositiveContractTier T0
  • policy-corpus 0
  • public-evidence-snapshot 20
  • regression-corpus 0
wandb-api-keywandbStabledocumentedT1provider-documentedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 35
  • regression-corpus 0
xai-api-keyxaiStableempiricalT2corroboratedNo hold recorded
  • policy-corpus 0
  • public-evidence-snapshot 41
  • regression-corpus 0
xata-api-keyxataProvisionalNo routeT1provider-documenteddocumented.minimumPositiveCasesdocumented.minimumPositiveAxesdocumented.minimumBenignCases4 more
  • policy-corpus 0
  • public-evidence-snapshot 0
  • regression-corpus 0

Taxonomy families with no detector

21 families in the taxonomy have no detector, so no status is derived for them.

atlassian:access-tokenaws:context-specific-credentialaws:sts-service-bearer-tokenaws:sts-temporary-access-keyexa:api-keygitlab:routable-personal-access-tokengoogle:oauth2-credentiallinear:oauth-access-tokenmailgun:legacy-signing-key-tripletmailgun:public-validation-keymistral:realtime-client-tokennetlify:other-prefixed-tokensnotion:integration-tokennpm:legacy-tokenopenrouter:management-api-keypinecone:legacy-api-keyslack:workflow-webhook-tokenstripe:organization-api-keyvercel:api-keyvercel:integration-tokenvoyage-ai:api-key

Cases no detector family claims

A case that maps to no product detector family stays in its population’s unattributed counts and is listed on its own pages, never dropped.

Open the unattributed cases

Known-gap inputs

Each record’s fixtures matched to cases by id, per population. A public fixture keeps its legacy id until the re-key, so it matches nothing here.
Known-gap inputs
RecordKindLedger statusFixtures matched, per populationFixtures
product-292Issue #292false-positivefixedNo fixture matched
2 named
  • reference-syntax--windows-env
  • reference-syntax--sql-bind
product-293Issue #293false-positivefixedNo fixture matched
1 named
  • reference-syntax--azure-keyvault
product-294Issue #294false-negativefixedNo fixture matched
3 named
  • detector-coverage--generic-token-api-key-quoted
  • detector-coverage--generic-token-password-quoted
  • detector-coverage--generic-token-client-secret-quoted
product-404Issue #404false-negativefixedNo fixture matched
1 named
  • common-formats--sendgrid-token-segmented-unicode-crlf
product-405Issue #405false-negativefixedNo fixture matched
9 named
  • detector-coverage--openai-token-shape-1-bare
  • detector-coverage--openai-token-shape-1-quoted
  • detector-coverage--openai-token-shape-1-unicode-crlf
  • detector-coverage--openai-token-shape-2-bare
  • detector-coverage--openai-token-shape-2-quoted
  • detector-coverage--openai-token-shape-2-unicode-crlf
  • detector-coverage--openai-token-shape-3-bare
  • detector-coverage--openai-token-shape-3-quoted
  • detector-coverage--openai-token-shape-3-unicode-crlf
product-406Issue #406false-negativefixedNo fixture matched
3 named
  • detector-coverage--slack-token-shape-1-bare
  • detector-coverage--slack-token-shape-1-quoted
  • detector-coverage--slack-token-shape-1-unicode-crlf
product-407Issue #407false-negativefixedNo fixture matched
3 named
  • detector-coverage--docker-token-shape-1-bare
  • detector-coverage--docker-token-shape-1-quoted
  • detector-coverage--docker-token-shape-1-unicode-crlf
product-408Issue #408false-negativefixedNo fixture matched
3 named
  • detector-coverage--cloudflare-token-shape-1-bare
  • detector-coverage--cloudflare-token-shape-1-quoted
  • detector-coverage--cloudflare-token-shape-1-unicode-crlf
product-551Issue #551false-positivefixedNo fixture matched
4 named
  • detector-coverage--linear-token-oauth-trailing-identifier-embedding
  • detector-coverage--linear-token-oauth-dash-identifier-embedding
  • detector-coverage--slack-token-rotation-trailing-identifier-embedding
  • detector-coverage--slack-token-rotation-dash-identifier-embedding
product-552Issue #552false-negativefixedNo fixture matched
3 named
  • detector-coverage--generic-token-api-key-markdown-inline-code-boundary
  • detector-coverage--generic-token-password-markdown-inline-code-boundary
  • detector-coverage--generic-token-client-secret-markdown-inline-code-boundary
product-553Issue #553false-positivepolicy-decision
  • regression-corpus 2 of 5 fixtures
5 named
  • detector-coverage--bearer-token-header-bare-twin
  • detector-coverage--bearer-token-header-quoted-twin
  • detector-coverage--bearer-token-header-unicode-crlf-twin
  • sendgrid-regressions--base62-bearer-twinregression-corpus · control · not flagged
  • sendgrid-regressions--base62-generic-key-twinregression-corpus · control · not flagged
product-428-sendgridIssue #428false-negativefixed
  • regression-corpus 2 of 2 fixtures
2 named
  • sendgrid-regressions--trailing-dash-generic-keyregression-corpus · positive · EXACT
  • sendgrid-regressions--url-safe-generic-keyregression-corpus · positive · EXACT
product-428-reference-syntaxIssue #428false-negativefixedNo fixture matched
6 named
  • reference-syntax--api-key
  • reference-syntax--password
  • reference-syntax--dotted-password
  • reference-syntax--quoted-password
  • reference-syntax--client-secret
  • reference-syntax--unicode-crlf
product-671Issue #671false-negativefixedNo fixture matched
3 named
  • detector-coverage--datadog-application-key-prefixed-env-marker-bare
  • detector-coverage--datadog-application-key-prefixed-env-marker-quoted
  • detector-coverage--datadog-application-key-prefixed-env-marker-unicode-crlf
product-672Issue #672false-negativefixedNo fixture matched
3 named
  • detector-coverage--new-relic-license-key-current-format-bare
  • detector-coverage--new-relic-license-key-current-format-quoted
  • detector-coverage--new-relic-license-key-current-format-unicode-crlf
product-670Issue #670false-negativefixedNo fixture matched
6 named
  • detector-coverage--discord-bot-token-three-segments-current-new-bot-bare
  • detector-coverage--discord-bot-token-three-segments-current-new-bot-quoted
  • detector-coverage--discord-bot-token-three-segments-current-new-bot-unicode-crlf
  • detector-coverage--discord-bot-token-three-segments-current-reset-bot-bare
  • detector-coverage--discord-bot-token-three-segments-current-reset-bot-quoted
  • detector-coverage--discord-bot-token-three-segments-current-reset-bot-unicode-crlf
product-707Issue #707false-negativefixedNo fixture matched
3 named
  • detector-coverage--microsoft-entra-client-secret-leading-dash-bare
  • detector-coverage--microsoft-entra-client-secret-leading-dash-quoted
  • detector-coverage--microsoft-entra-client-secret-leading-dash-unicode-crlf
product-708Issue #708false-negativefixedNo fixture matched
3 named
  • detector-coverage--docker-token-oat-27-bare
  • detector-coverage--docker-token-oat-27-quoted
  • detector-coverage--docker-token-oat-27-unicode-crlf
product-714Issue #714false-positivefixedNo fixture matched
1 named
  • detector-coverage--heroku-api-key-legacy-public-id
product-738Issue #738false-positivefixedNo fixture matched
3 named
  • beta8-209--confluent-cloud-api-secret-env-cloud-secret-checksum-twin
  • beta8-209--confluent-cloud-api-secret-kafka-client-properties-checksum-byte-order-twin
  • beta8-209--confluent-cloud-api-secret-cli-api-key-create-json-checksum-prefix-included-twin
product-739Issue #739false-positivepolicy-decisionNo fixture matched
2 named
  • beta8-209--confluent-cloud-api-secret-secrets-manager-json
  • beta8-209--confluent-cloud-api-secret-secrets-manager-json-alphabet-twin
product-740Issue #740false-negativefixedNo fixture matched
2 named
  • beta8-209--heroku-api-key-env-g1
  • beta8-209--heroku-api-key-authorizations-create-g1
product-749Issue #749false-negativefixedNo fixture matched
1 named
  • beta8-209--google-api-key-firebase-web-config
product-741Issue #741false-negativefixedNo fixture matched
10 named
  • beta8-207--atlassian-api-token-env
  • beta8-207--atlassian-api-token-curl-basic
  • beta8-207--atlassian-api-token-python-client-yaml
  • beta8-207--atlassian-api-token-jira-client
  • beta8-207--atlassian-api-token-pipelines-variable
  • beta8-207--atlassian-api-token-settings-json
  • beta8-207--atlassian-api-token-acli-login
  • beta8-207--atlassian-api-token-compose-env
  • beta8-207--atlassian-api-token-debug-log
  • beta8-207--atlassian-api-token-ticket-paste
product-742Issue #742false-positivefixedNo fixture matched
3 named
  • beta8-207--supabase-token-short-random-twin
  • beta8-207--supabase-token-long-checksum-twin
  • beta8-207--supabase-token-dash-delimiter-twin
product-743-multi-lineIssue #743false-negativefixedNo fixture matched
2 named
  • beta8-207--heroku-api-key-legacy-netrc-multi-line
  • beta8-207--heroku-api-key-legacy-auth-token-output
product-743-url-pathIssue #743false-positivefixedNo fixture matched
1 named
  • beta8-207--heroku-api-key-legacy-app-url-path-public-id
product-744Issue #744false-positivefixedNo fixture matched
2 named
  • beta8-207--twilio-auth-token-package-md5-encoded-value
  • beta8-207--confluent-cloud-api-secret-legacy-image-digest-encoded-value
product-745Issue #745false-positivefixedNo fixture matched
1 named
  • beta8-207--bearer-token-your-access-token-placeholder
product-746Issue #746false-positivefixedNo fixture matched
1 named
  • beta8-207--twilio-api-key-secret-wrong-companion-near-miss
product-747Issue #747false-positivefixedNo fixture matched
1 named
  • beta8-207--atlassian-api-token-account-id-public-id
product-754Issue #754false-negativefixedNo fixture matched
4 named
  • beta8-213c--new-relic-license-key-newrelic-yml
  • beta8-213c--new-relic-license-key-newrelic-js-config
  • beta8-213c--new-relic-license-key-log-api-license-header
  • beta8-213c--new-relic-license-key-helm-bundle-values
product-756Issue #756false-positivefixedNo fixture matched
2 named
  • beta8-213d--mailchimp-api-key-docs-template-placeholder
  • beta8-212--pinecone-api-key-header-placeholder-placeholder
product-727Issue #727false-positivefixedNo fixture matched
1 named
  • beta8-208--xai-api-key-key-metadata-public-id
product-264Issue #264false-positivefixedNo fixture matched
1 named
  • beta8-208--groq-api-key-masked-console-placeholder
product-730Issue #730false-positivefixedNo fixture matched
1 named
  • beta8-212--fireworks-ai-api-key-keychain-reference-reference
product-702Issue #702false-negativefixedNo fixture matched
9 named
  • beta8-212--pinecone-api-key-legacy-dotenv
  • beta8-212--pinecone-api-key-legacy-export
  • beta8-212--pinecone-api-key-legacy-legacy-init
  • beta8-212--pinecone-api-key-legacy-yaml-config
  • beta8-212--pinecone-api-key-legacy-actions-env
  • beta8-212--pinecone-api-key-legacy-compose-env
  • beta8-212--pinecone-api-key-legacy-langchain
  • beta8-212--pinecone-api-key-legacy-terraform-output
  • beta8-212--pinecone-api-key-legacy-shell-key
product-815Issue #815false-negativeverifiedNo fixture matched
4 named
  • beta9-external-inputs--composed-json-string-in-json-log
  • beta9-external-inputs--ds-keyword-template-chars-in-secret
  • beta9-external-inputs--ds-keyword-go-short-assign
  • beta9-external-inputs--ds-objc-at-string
product-816Issue #816false-negativeverifiedNo fixture matched
7 named
  • beta9-external-inputs--rfc6750-query-access-token
  • beta9-external-inputs--rfc6750-get-request-line
  • beta9-external-inputs--rfc6749-implicit-fragment-display-break
  • beta9-external-inputs--rfc6749-authorization-code-location
  • beta9-external-inputs--rfc7636-code-verifier
  • beta9-external-inputs--rfc6749-refresh-request-body
  • beta9-external-inputs--rfc6749-token-request-basic-and-code
product-817Issue #817false-positiveverifiedNo fixture matched
5 named
  • beta9-external-inputs--np-html-escaped-placeholder
  • beta9-external-inputs--np-echo-concatenated-reference
  • beta9-external-inputs--np-env-attribute-reference
  • beta9-external-inputs--np-java-getter-concatenation
  • beta9-external-inputs--np-iam-managed-policy-arn
product-818Issue #818false-negativeverifiedNo fixture matched
3 named
  • beta9-external-inputs--rfc7617-basic-utf8-proxy
  • beta9-external-inputs--composed-curl-single-quoted-json
  • beta9-external-inputs--composed-zero-width-inside-bearer
product-819Issue #819false-negativeverifiedNo fixture matched
3 named
  • beta9-external-inputs--rfc8959-secret-token-folded-bearer
  • beta9-external-inputs--rfc8959-secret-token-prose
  • beta9-external-inputs--composed-secret-token-uppercase-scheme
product-820Issue #820false-negativeverifiedNo fixture matched
1 named
  • beta9-external-inputs--composed-userinfo-password-url
product-821Issue #821false-negativeverifiedNo fixture matched
1 named
  • beta9-external-inputs--composed-jwk-k-single-line
product-822Issue #822false-negativepolicy-decisionNo fixture matched
3 named
  • beta9-external-inputs--rfc7519-jwt-display-breaks
  • beta9-external-inputs--rfc7515-jwk-k-display-break
  • beta9-external-inputs--composed-percent-encoded-url-in-json
product-823Issue #823false-negativepolicy-decisionNo fixture matched
3 named
  • beta9-external-inputs--ds-keyword-reversed-comparison
  • beta9-external-inputs--ds-cpp-string-constructor
  • beta9-external-inputs--ds-keyword-non-ascii-secret
product-824Issue #824false-positivepolicy-decisionNo fixture matched
2 named
  • beta9-external-inputs--ds-fake-in-value
  • beta9-external-inputs--np-css-selector
product-825Issue #825false-negativepolicy-decisionNo fixture matched
5 named
  • beta9-external-inputs--composed-yaml-block-scalar-json
  • beta9-external-inputs--rfc6750-token-response-json
  • beta9-external-inputs--composed-prefixed-key-name-secret
  • beta9-external-inputs--np-generic-password-dollar
  • beta9-external-inputs--np-generic-user-password-pair
product-911Issue #911false-positiveverifiedNo fixture matched
7 named
  • real-world-shapes--helm-values-search-api
  • real-world-shapes--k8s-billing-externalsecret
  • real-world-shapes--ansible-group-vars-gameservers
  • real-world-shapes--swift-keychain-wrapper
  • real-world-shapes--pytest-fake-fixtures
  • real-world-shapes--lua-openresty-hmac
  • real-world-shapes--agent-summary-korean-rotation
product-931Issue #931false-negativeverifiedNo fixture matched
3 named
  • beta8-379--mailchimp-api-key-python-requests-auth
  • beta8-379--mailchimp-api-key-ticket-paragraph
  • beta8-379--mailchimp-api-key-debug-request-headers
product-932Issue #932false-negativeverifiedNo fixture matched
3 named
  • beta8-379--deepgram-api-key-httpie-token
  • beta8-379--deepgram-api-key-go-client-literal
  • beta8-379--cohere-api-key-java-builder-token
product-933Issue #933false-negativeverifiedNo fixture matched
3 named
  • beta8-379--heroku-api-key-legacy-authorizations-info
  • beta8-379--confluent-cloud-api-secret-legacy-schema-registry-user-info
  • beta8-379--twilio-auth-token-profiles-auth-token
product-934Issue #934false-positiveverifiedNo fixture matched
2 named
  • beta8-379--heroku-api-key-legacy-zero-uuid-placeholder
  • beta8-379--stripe-token-docs-x-body-placeholder
product-935Issue #935false-negativeverifiedNo fixture matched
1 named
  • beta8-379--connection-string-sqlalchemy-ipv6
product-936Issue #936false-negativepolicy-decisionNo fixture matched
8 named
  • beta8-379--new-relic-license-key-python-newrelic-ini
  • beta8-379--new-relic-license-key-terraform-tfvars-eu
  • beta8-379--new-relic-license-key-agent-startup-json
  • beta8-379--deepgram-api-key-worker-json-log
  • beta8-379--heroku-api-key-legacy-platform-api-ruby
  • beta8-379--heroku-api-key-legacy-git-config-remote
  • beta8-379--confluent-cloud-api-secret-legacy-client-config-create
  • beta8-379--twilio-auth-token-validator-debug
product-949Issue #949false-positiveverifiedNo fixture matched
3 named
  • beta8-436c--inngest-signing-key-sdk-short-placeholder
  • beta8-436d--resend-api-key-digits-placeholder
  • beta8-436d--resend-api-key-your-key-placeholder
product-1015Issue #1,015false-positiveverifiedNo fixture matched
1 named
  • beta8-384a--anthropic-admin01-key-angle-key-placeholder
product-1016Issue #1,016false-negativeverifiedNo fixture matched
3 named
  • beta8-384e--deepgram-api-key-k8s-env-value
  • beta8-384e--cohere-api-key-k8s-env-value
  • beta8-384e--mistral-api-key-k8s-env-value
product-1017Issue #1,017false-negativeverifiedNo fixture matched
2 named
  • beta8-384e--deepgram-api-key-create-client
  • beta8-384e--deepgram-api-key-websocket-subprotocol
product-1038Issue #1,038false-negativeverifiedNo fixture matched
1 named
  • beta8-384e--mistral-api-key-python-environ-assign
product-1018Issue #1,018false-negativeverifiedNo fixture matched
1 named
  • beta8-379--cohere-api-key-litellm-proxy-debug
product-1041Issue #1,041false-positiveverifiedNo fixture matched
1 named
  • real-world-shapes--rust-secrecy-config
product-1042Issue #1,042false-positiveverifiedNo fixture matched
7 named
  • beta8-1012e--vercel-personal-access-token-x-run-placeholder
  • beta8-1012e--vercel-app-access-token-x-run-placeholder
  • beta8-1012e--vercel-app-refresh-token-x-run-placeholder
  • beta8-464f--runpod-api-key-word-fixture-placeholder
  • beta8-528h--paddle-api-key-ellipsis-placeholder
  • beta8-528a--bitwarden-secrets-manager-access-token-x-run-placeholder
  • beta8-464b--clickhouse-cloud-api-secret-docs-placeholders-placeholder
product-1236Issue #1,236false-positivepromotedNo fixture matched
3 named
  • beta8-583a--square-token-your-access-token-placeholder
  • beta8-583a--square-token-angle-brackets-placeholder
  • beta8-583a--square-oauth-application-secret-angle-brackets-placeholder