Browserbase API keys

• Provider documentation browserbase/cookbook scripts/verify.py CI gate (2026-09-25, a public Browserbase-organization member; R2): (?<!\w)bb_live_[A-Za-z0-9]{20,}(?!\w); the same author's import_sources.py filter uses the same body inside [A-Za-z0-9_-] boundaries; docs placeholders bb_live_... (R4); re-checked 2026-09-28 · observed 2026-09-29 · bb_live_ + at least 20 [A-Za-z0-9], open-ended; no separator or checksum; bb_test_ is not part of the family
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12

Arrival evidence (#464, product redact-secret#973; #860 handoff browserbase.md, READY for bb_live_ with an open-ended body). T1: the bb_live_ prefix is the docs placeholder (R4) and a provider redaction regex bb_(live|test)_ in browserbase/stagehand (R2); the alphabet and the floor of 20 are a provider CI gate whose author is a public Browserbase-organization member (R2), and no public scanner has a Browserbase rule, so it is not a vendored rule. The stagehand redactor admits _ and - after four alphanumerics while the CI gate is alphanumeric only; both are provider-authored, and the contract takes the alphanumeric class, which keeps bb_live_session_ style identifiers out. POLICY, not T1: the 128-byte upper bound (a bounded run for streaming; rejected whole, never truncated), so positives reach 128 and nothing asserts silence on 129. Excluded: bb_test_ keys (issuance-gated: only a floor-5 regex and a T2 comment), bb_live_session_ and other snake_case identifiers, bb_live_... and bb_live_your_api_key_here placeholders, bb_<timestamp> cookie names and project-ID UUIDs. Neither pinned peer has a Browserbase rule. Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1037).