AWS secret access keys

• awslabs/git-secrets (AWS-authored, R2 not applied)
• awslabs/ferret-scan (AWS-authored, R2 not applied)
• trufflehog (HEAD)
• noseyparker
• osv-scalibr
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12
• Reference 13
• Reference 14
• Reference 15

Context-gated registry family (#1012 READY-T2, context-constrained; product redact-secret#1028, a registry detector since the 4fb7882 pin). The secret half of a long-term IAM user access key: with its AKIA id it signs any API call the user may make. T2: exactly 40 [A-Za-z0-9/+] is the AWS docs example shape (R5) and the grammar of two AWS-owned scanner rules (git-secrets, ferret-scan; R2 would make them T1 but is not applied) and of peers from Truffle Security, Praetorian and Google; no AWS page states "40 characters" in prose. The value has no prefix, and AWS's own detectors require context (Macie: "Keyword required: Yes"), so the family is recognised only under an AWS secret key name (aws_secret_access_key, AWS_SECRET_ACCESS_KEY, SecretAccessKey, secret_access_key, aws_secret_key, "secret access key") or next to an AKIA access key id; its positives score as project policy and its context twins keep the value byte-for-byte and remove that gate. = inside the 40 is excluded (30 random bytes encode to 40 characters without padding; ferret-scan, trufflehog and veles agree). Excluded: a bare 40-character run, temporary (ASIA-paired) secrets (the only AWS example is 41 characters), and session tokens. No fixture asserts silence on a 40-character Base64 value beside the gate: the contract admits any such value there.