Cerebras API keys

• Provider documentation Cerebras/vscode-cerebras-chat src/provider.ts (e03602f; the check was introduced on 2025-08-29 with csk- only and the 52 has stayed): a key that does not start csk_ or csk- or whose length is not 52 is rejected; a Cerebras staff member wrote on 2025-10-23 and 2025-10-24 that customers hold keys with both prefixes, csk_ was an unintentional recent change, new keys use csk-, and both should be accepted (R3); re-checked 2026-09-28 · observed 2026-09-29 · csk- or csk_ + exactly 48 body bytes (52 in all); the body alphabet is project policy under R10, not a provider fact
• betterleaks and other tool rules (unpinned)
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12
• Reference 13
• Reference 14
• Reference 15

Arrival evidence (#464, product redact-secret#975; #860 handoff cerebras.md, READY by ruling R10). T1: the length comes from the provider VS Code extension validator, which rejects any key that does not start csk_ or csk- or is not 52 long (R1), and both prefixes are a dated provider-staff statement (R3, as of 2025-10; provider docs state "starts with csk-"). POLICY under R10, not T1: no provider source states the alphabet (the validator accepts any 48 code units) and the [a-z0-9] class is tool-only, so project policy fills it with [A-Za-z0-9_-], a superset of every class seen with no narrowing from third-party rules (R8). Positives therefore include lowercase-only bodies and bodies with _ and -, and no fixture asserts silence on a byte outside the policy class (a dot or plus in the body is not authored either way). The leading boundary is load-bearing: it excludes Pinecone pcsk_ / pcsk- (the byte before csk is p; Pinecone keeps pcsk_ with a 69- or 70-byte body, so no width overlaps). Excluded: Management API keys (shape unknown), csk-your-key-here style placeholders and other widths. The tool rules' [a-z0-9] body is narrower than the policy class, so a tool that follows it lags on any uppercase, _ or - body. Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1037).