redact-secret · Report

Detectors

One row per detector family the product registers, by the fixtures that exercise it. The line on each bar is the minimum sample size below which the run withholds a bound.

135 detectors
0 at or below the minimum
Run 2026-10-07
Mode published · redact-secret 0.1.0-beta.14

New pipelineAuthority

Built from the new pipeline

The new pipeline is the authority for credential qualification. These numbers are read from the qualification view derived from the official credential-eval run of the public-evidence-snapshot population. The regression and policy populations keep their own counts on the qualification pages and are not added in here.

Authority: new
Population: public-evidence-snapshot
Engine: credential-eval 0.1.0-alpha.16
Evidence: snapshot-2026.10.06.4
Run: sha256:4bec6e539482…
Recorded: 2026-10-07
Authorised for: @redact-secret/core@0.1.0-beta.14

Maintainer-reviewed (independent review pending)

598 fixtures of the 7,041 in evidence release snapshot-2026.10.06.4 carry this label. They are counted in the numbers on this page.

Passed the project’s own verification (source evidence, automated checks, recorded counter-arguments); not yet independently reviewed.

OpenRedaction default (all patterns): not measured in this run (optional)

The default (all-pattern) profile is slow and noisy for credential evaluation: personal data and resource identifiers dominate its findings, and its last official measurement took 7 minutes of scanner time on a population the credential profile scans in seconds (its methods run takes 40+ minutes), so it is a manual measurement and never blocks other scanners or core verification (#763). Its earlier results stay as history with their run identity; the credential profile is a separate scanner, never spliced with it.

Last measurement: policy-corpus@linux-x64 (configuration sha256:2451ce7bf380), public-evidence-snapshot+methods@linux-x64 (configuration sha256:d47d081ce5fb), public-evidence-snapshot@linux-x64 (configuration sha256:2451ce7bf380), regression-corpus@linux-x64 (configuration sha256:2451ce7bf380) · engine 0.1.0-alpha.5 · recorded 2026-10-05 · retained record, no longer listed by the run registry. It stays labelled with that run identity and is never combined with another profile or another run.

Open the qualification page for this pointer

OpenRedaction credential profile (33 types): not measured in an official run (local exploratory diagnostics only: see ADR)

The credential profile is the comparison profile chosen in docs/decisions/2026-10-06-choose-the-openredaction-credential-bearing-profile-as-the-comparison-scanner.md. It is optional in the official run class because no pinned engine configuration measures it yet: making it required would refuse every official view until the owner approves the one profile-only run. Its own history starts with that run; nothing of the default's is reused for it.

No earlier measurement of it is recorded. Nothing is shown in its place.

Official measurement: pending: requires owner approval (one profile-only run; see the decision).

Open the qualification page for this pointer

Every population and its qualification

Find

135 detectors

Detectors by fixture count
Detector	Fixtures	Sample size	Against the minimum
Generic tokens`generic-token`	237
GitHub tokens`github-token`	201
SendGrid tokens`sendgrid-token`	167
Stripe tokens`stripe-token`	136
Connection strings`connection-string`	104
Deepgram API keys`deepgram-api-key`	82
Cohere API keys`cohere-api-key`	78
Mistral API keys`mistral-api-key`	68
AWS secret access keys`aws-secret-access-key`	64
Twilio auth tokens`twilio-auth-token`	64
Heroku API tokens (legacy UUID)`heroku-api-key-legacy`	63
AI21 API keys`ai21-api-key`	60
Confluent Cloud API secrets (legacy, unprefixed)`confluent-cloud-api-secret-legacy`	60
GitLab tokens`gitlab-token`	57
Together AI API keys`together-ai-api-key`	56
npm tokens`npm-token`	55
Mailchimp Marketing API keys`mailchimp-api-key`	54
Bearer tokens`bearer-token`	52
Datadog application keys (legacy 40-hex)`datadog-application-key-legacy`	52
Doppler tokens`doppler-token`	51
Trigger.dev tokens`trigger-dev-token`	50
Twilio API key secrets`twilio-api-key-secret`	50
Composio API keys`composio-api-key`	48
Firecrawl API keys`firecrawl-api-key`	48
Travis CI API tokens`travisci-api-token`	48
Databricks personal access tokens`databricks-personal-access-token`	47
OpenAI tokens`openai-token`	47
Slack tokens`slack-token`	47
Bitwarden Secrets Manager access tokens`bitwarden-secrets-manager-access-token`	46
Cerebras API keys`cerebras-api-key`	46
Discord bot tokens`discord-bot-token`	46
Postman API keys`postman-api-key`	46
Atlassian API tokens`atlassian-api-token`	45
ClickHouse Cloud API secrets`clickhouse-cloud-api-secret`	45
Firebase server keys`firebase-server-key`	45
Helicone API keys`helicone-api-key`	45
Microsoft Entra client secrets`microsoft-entra-client-secret`	45
Tavily API keys`tavily-api-key`	45
Amazon Bedrock long-term API keys`aws-bedrock-long-term-api-key`	44
Daytona API keys`daytona-api-key`	44
PostHog tokens`posthog-token`	44
E2B API keys`e2b-api-key`	43
GitLab runner authentication tokens`gitlab-runner-authentication-token`	43
Mailgun API and HTTP signing keys`mailgun-api-key`	43
openai-admin-api-key`openai-admin-api-key`	43
Pinecone API keys`pinecone-api-key`	43
Langfuse secret keys`langfuse-secret-key`	42
LangSmith API keys`langsmith-api-key`	42
Neon API keys`neon-api-key`	42
New Relic license keys`new-relic-license-key`	42
Postman collection access keys`postman-collection-access-key`	42
Resend API keys`resend-api-key`	42
Convex deployment keys`convex-deployment-key`	41
Dynatrace tokens`dynatrace-token`	41
Groq API keys`groq-api-key`	41
Paddle API keys`paddle-api-key`	41
Perplexity API keys`perplexity-api-key`	41
xAI API keys`xai-api-key`	41
Docker tokens`docker-token`	40
github-fine-grained-pat`github-fine-grained-pat`	40
Google OAuth client secrets`google-oauth-client-secret`	40
Inngest signing keys`inngest-signing-key`	40
Okta API tokens`okta-api-token`	40
Sentry org auth tokens`sentry-org-auth-token`	40
Sentry user auth tokens`sentry-user-auth-token`	40
slack-app-level-token`slack-app-level-token`	40
SonarQube tokens`sonarqube-token`	40
Telegram bot tokens`telegram-bot-token`	40
vercel-app-access-token`vercel-app-access-token`	40
vercel-app-refresh-token`vercel-app-refresh-token`	40
vercel-personal-access-token`vercel-personal-access-token`	40
1Password service account tokens`onepassword-service-account-token`	39
anthropic-admin01-key`anthropic-admin01-key`	39
DigitalOcean tokens`digitalocean-token`	39
Honeycomb API keys`honeycomb-api-key`	39
NVIDIA API keys`nvidia-api-key`	39
RubyGems API keys`rubygems-api-key`	39
Apify API tokens`apify-api-token`	38
Browserbase API keys`browserbase-api-key`	38
ElevenLabs API keys`elevenlabs-api-key`	38
Polar tokens`polar-token`	38
anthropic-api01-key`anthropic-api01-key`	37
Axiom tokens`axiom-token`	37
Clojars deploy tokens`clojars-deploy-token`	37
crates.io tokens`crates-io-token`	37
doppler-service-account-token`doppler-service-account-token`	37
composio-org-api-key`composio-org-api-key`	36
composio-user-api-key`composio-user-api-key`	36
Datadog API keys`datadog-api-key`	36
doppler-audit-token`doppler-audit-token`	36
doppler-cli-token`doppler-cli-token`	36
doppler-personal-token`doppler-personal-token`	36
doppler-scim-token`doppler-scim-token`	36
doppler-service-account-identity-token`doppler-service-account-identity-token`	36
Grafana Cloud access policy tokens`grafana-cloud-access-policy-token`	36
Grafana service account tokens`grafana-service-account-token`	36
helicone-write-api-key`helicone-write-api-key`	36
New Relic user API keys`new-relic-user-api-key`	36
posthog-project-secret-api-key`posthog-project-secret-api-key`	36
Private keys`private-key`	36
RunPod API keys`runpod-api-key`	36
W&B API keys`wandb-api-key`	35
Amazon Bedrock short-term API keys`aws-bedrock-short-term-api-key`	34
Fireworks AI API keys`fireworks-ai-api-key`	32
Google API keys`google-api-key`	32
OpenRouter API keys`openrouter-api-key`	32
Replicate API tokens`replicate-api-token`	32
AWS access keys`aws-access-key`	31
Confluent Cloud API secrets`confluent-cloud-api-secret`	31
Anthropic tokens`anthropic-token`	30
Supabase tokens`supabase-token`	30
Azure DevOps personal access tokens`azure-devops-personal-access-token`	29
crates-io-trusted-publishing-token`crates-io-trusted-publishing-token`	29
Datadog application keys`datadog-application-key`	29
Heroku API tokens`heroku-api-key`	29
Notion tokens`notion-token`	29
stripe-webhook-signing-secret`stripe-webhook-signing-secret`	29
polar-api-credential`polar-api-credential`	28
sonarqube-analysis-token`sonarqube-analysis-token`	28
trigger-dev-personal-access-token`trigger-dev-personal-access-token`	28
Vault tokens`vault-token`	28
Linear tokens`linear-token`	27
Shopify tokens`shopify-token`	27
slack-user-token`slack-user-token`	27
Hugging Face tokens`huggingface-token`	26
JWT`jwt`	26
Pulumi access tokens`pulumi-access-token`	26
PyPI tokens`pypi-token`	26
Supabase personal access tokens`supabase-management-token`	26
Terraform Cloud tokens`terraform-cloud-token`	26
axiom-personal-token`axiom-personal-token`	25
Cloudflare tokens`cloudflare-token`	24
Netlify personal access tokens`netlify-token`	24
OTP authentication URIs`otpauth-uri`	24
Vercel tokens`vercel-token`	20

Detector assignments overlap: a fixture can exercise several detectors, so these counts are never summed. The minimum sample size is 5 fixtures.