Confluent Cloud API secrets (legacy, unprefixed)

• trufflehog 3.97.4
• gitleaks 8.30.1

docs.confluent.io states that API secrets created before 2025-07-30 "may not include cflt; both old and new formats continue to work for authentication" and documents no grammar for them beyond the prefixed form's 64-character total. A bare 64-byte base64-body run has no marker of its own, so, like twilio-auth-token and datadog-api-key, the value is scored as policy and only beside a same-line confluent keyword: gitleaks 8.30.1's confluent-secret-key rule (keyword-gated [a-z0-9]{64}) and trufflehog 3.97.4's confluent detector (keyword-gated [a-zA-Z0-9+/]{64}) both corroborate exactly that policy and never report a bare 64-byte run unconditionally. gitleaks's (?i)[a-z0-9]{64} class admits uppercase but never "+" or "/", so it misses a secret carrying either byte the provider alphabet allows; recorded as a peer tradeoff, not adopted. The length twin rests on both tools' exact 64-byte rules, since the provider page states no length for the unprefixed form; provider examples and Terraform test data show 64 but one provider Basic-auth example shows 60 (#233), so no fixture asserts silence on a 60-character value. The 16-character API key ID is documented as not secret. A current cflt secret is a sibling of another family: it appears only as a twin scoped to this family, never as a benign control. redact-secret#309 (PR #667) froze the same keyword-gated Medium-confidence shape on the product side.