Doppler tokens

• Provider documentation auth-token-formats regex for dp.st. (page dateModified 2025-05-29, re-checked 2026-09-28) · observed 2026-09-28 · the provider states the dp.st. prefix, the optional [a-z0-9_-]{2,35} environment segment, a 40–44 byte [A-Za-z0-9] body and the . separators as a regex; no checksum is documented
• trufflehog 3.97.4
• gitleaks 8.30.1
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7

Arrival evidence (#434, product redact-secret#903; #860 handoff doppler.md, READY). T1 on every field: one Doppler page states the regex for each of the seven dp.<type>. roles, and this family is the service token (reads one config). The optional environment segment ([a-z0-9_-]{2,35} then .) belongs to dp.st. only; a segment outside that grammar is not claimed, and the dp.st… display preview (a Unicode ellipsis plus the last six body bytes) is a benign control. All documentation examples have a 43-byte body; the contract keeps the documented 40–44 band. Scanner rules lag the page and are corroboration only (gitleaks 8.30.1 covers dp.pt. only). No fixture asserts a body width outside 40–44 as a key, and no future type is asserted either way. Graduated to a registry detector at the 1127bf9 re-pin (redact-secret PR #938).