crates.io tokens

• Provider documentation rust-lang/crates.io crates/crates_io_database/src/utils/token.rs (7b2475e, 2025-12-01): TOKEN_PREFIX = "cio", TOKEN_LENGTH = 32, rand::distr::Alphanumeric; HashedToken::parse rejects any token without the prefix; re-checked 2026-09-29 · observed 2026-09-29 · cio + exactly 32 [A-Za-z0-9], 35 in all; no separator or checksum
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10

Arrival evidence (#528, product redact-secret#1031; #1014 handoff crates-io.md, READY). An API token publishes, yanks and changes owners of crates within its scopes. T1 for every fact under R1 from the provider server code; unprefixed pre-cio tokens are no longer accepted. cio is a trigram, so the exact 32-byte body and both identifier boundaries (handoff decision) keep it precise: a random standalone 35-byte alphanumeric value that starts with cio (about 1 in 238,000) is the accepted false positive. The body excludes _, so a cio_tp_ token never reads as an API token. Excluded: words and identifiers that start with cio (ciound, cio_config) and cio + 32 inside a longer run. Neither pinned peer has a crates.io rule. Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1039).