Google OAuth client secrets

• google/osv-scalibr (Google-authored, R2 not applied)
• noseyparker
• CredSweeper
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12

Registry family (#1012 READY-T2; product redact-secret#1029, a registry detector since the 4fb7882 pin). The client secret of a Google OAuth client: with the public client id it completes authorization-code exchanges and refreshes tokens as that client. Installed-app secrets are treated by Google as non-confidential and web-app secrets as confidential; both share the prefix and the redaction default. T2: three dated references from three owners in two classes (Google's own osv-scalibr rule, provider-authored code, narrowed to exactly 28 in Google's commit; noseyparker; CredSweeper) state GOCSPX- + exactly 28 [A-Za-z0-9_-]; R2 would make the Google rule T1 but is not applied. Google publishes no format, and since mid-2025 the console shows only the last four characters. Google-owned repositories that commit installed-app secrets of the same width are issued values and are not counted. Excluded: unprefixed pre-GOCSPX secrets (context only), the public client id (<digits>-<id>.apps.googleusercontent.com), and the ya29. access and 1// refresh tokens, which are BLOCKED in the research record.