Mailgun API and HTTP signing keys

• trufflehog 3.97.4
• gitleaks 8.30.1

Mailgun's own "Create a key" API reference (documentation.mailgun.com/docs/mailgun/api-reference/send/mailgun/keys/post-v1-keys, observed 2026-09-23) shows the created secret only as the placeholder "api-key-be-careful" and states no prefix, length or alphabet. Both pinned tools agree on a literal key- and a 32-byte body: gitleaks 8.30.1's mailgun-private-api-token rule (keyword- and assignment-gated) pins key-[a-f0-9]{32}, trufflehog 3.97.4's mailgun "Key-MailGun Token" pattern `\b(key-[a-z0-9]{32})\b` the wider lowercase-alphanumeric body with no keyword. This contract adopts trufflehog's wider alphabet, the reading the product froze from an independently observed real key whose body carries non-hex letters (redact-secret#314, PR #680), so a hex-only-alphabet twin is not constructible and gitleaks is an expected false negative on any body byte in g–z. The product's module doc cites Mailgun's account-management reference (GET/POST /v5/accounts/http_signing_key) as showing the identical key- + 32-byte shape for the HTTP webhook signing key; that page could not be re-fetched from this environment (its rendered reference returns 404 to a plain fetch), so the signing-key positive here rests on the product's citation plus the same tool corroboration, and no providerSource or twinSource is claimed. The superseded 32-8-8 hex triplet both tools still call a Mailgun signing key (gitleaks mailgun-signing-key; trufflehog "Hex MailGun Token") and trufflehog's 72-byte "Original MailGun Token" are known unsupported legacy variants with no contract. pubkey- (the public validation key gitleaks's mailgun-pub-key rule targets) is documented public and is the family's public-identifier control. Every positive carries the same-line mailgun keyword the product's Medium-confidence gate and gitleaks's rule require; a keyword-less key is an accepted product false negative not fixtured here, per the mailchimp-api-key precedent. Since 2026-09-24 (docs/decisions/2026-09-24-stop-asserting-provider-undecided-format-properties.md) whether a key- body may carry an uppercase letter is outside the claim: gitleaks and Nosey Parker are case-insensitive, trufflehog is not, no Mailgun source decides it, and no scored fixture asserts it either way.