Atlassian API tokens

• gitleaks 8.30.1

Atlassian explicitly disclaims a fixed token length. Gitleaks's atlassian-api-token rule corroborates the ATAT-prefixed family with a narrower, more specific shape (literal ATATT3 prefix, exact 186-byte body) than this minimum-length contract. The pinned TruffleHog atlassian detector instead targets the distinct ATCT access-token family, not this API-token shape. Re-checked 2026-09-22 (#207, redact-secret#643): every observed modern token, including one the maintainer issued, is 192 characters (the fixed ATATT3xFfGF0 header, 171 body characters, a single =, then 8 uppercase hex characters that two tools read as a CRC32), so the pattern admits that optional =<8 uppercase hex> suffix; without it an observed token could not satisfy the anchored contract. The 100-character body floor is unchanged, the length stays a floor because Atlassian calls it varied, and the ATCT/ATBB siblings are secrets of other token kinds, never controls here.