Clojars deploy tokens

• Provider documentation clojars/clojars-web src/clojars/db.clj (442eb89, last changed 2026-09-16): generate-deploy-token = (str "CLOJARS_" (hexadecimalize (generate-secure-token 30))), hexadecimalize formats %02X then lowercases, and is-deploy-token? is #"^CLOJARS_[0-9a-f]{60}$"; re-checked 2026-09-29 · observed 2026-09-29 · CLOJARS_ + exactly 60 lowercase hex, 68 in all; no checksum
• gitleaks 8.30.1
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8

Arrival evidence (#528, product redact-secret#1025; #1014 handoff clojars.md, READY). A deploy token is the password for deploying artifacts to Clojars (CLOJARS_PASSWORD, ~/.lein/credentials, Maven settings.xml), optionally scoped to a group or artifact; a leak is a supply-chain risk. T1 for every fact under R1: the generator and the server validator agree, so the contract is exactly the validator. The prefix is case-sensitive. Excluded: legacy account passwords (no shape), CLOJARS_USERNAME/CLOJARS_PASSWORD/CLOJARS_ENVIRONMENT names and uppercase-hex bodies (the validator rejects them). gitleaks 8.30.1 clojars-api-token is case-insensitive over [a-z0-9] with no boundary, so it overreaches on the lowercase-prefix, uppercase-hex, non-hex-letter, leading-glue and 61-byte twins; trufflehog 3.97.4 has no rule. Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1039).