ClickHouse Cloud API secrets

• Provider documentation gitleaks PR #1826 (merged 2025-04-16), authored by a ClickHouse employee: "we specifically choose a prefix (4b1d...)" and the rule 4b1d[A-Za-z0-9]{38}; 4b1d + 38 mixed-case alphanumeric examples in the provider-owned Terraform provider since 2023-05; a 42-byte unit-test fixture from 2024-07 (re-checked 2026-09-28) · observed 2026-09-29 · 4b1d + exactly 38 [A-Za-z0-9] (42 in all); no separator or checksum; T1 as of 2025-04-16 (R3), which sets aside the older 2023 39-byte knowledge-base example
• gitleaks 8.30.1
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12

Arrival evidence (#464, product redact-secret#971; #860 handoff clickhouse-cloud.md, READY). T1 as of 2025-04-16: a ClickHouse employee stated the 4b1d prefix in gitleaks PR #1826 (R3) and authored the rule 4b1d[A-Za-z0-9]{38} (R2), and the provider-owned Terraform examples and a 2024 unit-test fixture carry 42-byte 4b1d values. One provider knowledge-base example is 39 bytes (2023-09-02); R3 date order sets it aside, so a 39-byte total is a twin, not a positive. POLICY, not T1: the product requires at least one uppercase letter in the body (removes hex digests and lowercase ids that start 4b1d; false-negative cost about 1e-9), and the staff regex does not, so every positive is mixed case and no fixture asserts silence on a lowercase body. The leading boundary matters because 4b1d is valid hex: a longer hex or base64 run containing 4b1d must not match mid-run. Excluded: the key ID (no prefix, 17 or 20 alphanumerics, unresolved), UUIDs containing -4b1d-, 40- and 64-hex digests starting 4b1d, secrets supplied through the API's hashData (caller-chosen shape) and placeholders such as mykeysecret. Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1037).