NVIDIA API keys

• Provider documentation NVIDIA-NeMo/nemo-helix pii_scan.py (added 2026-05-21): \bnvapi-[A-Za-z0-9_\-]{60,}\b, a provider-authored rule (R2); NVIDIA/SkillEvaluator secrets.py nvapi-[A-Za-z0-9_-]{40,}; the ngcsdk constant SCOPED_KEY_PREFIX = "nvapi-" with an executing startswith (R1, R6); re-checked 2026-09-28 · observed 2026-09-29 · nvapi- + at least 60 [A-Za-z0-9_-], open-ended; NGC Personal, NGC Service and build.nvidia.com keys share the prefix; no separator or checksum
• trufflehog 3.97.4
• betterleaks (unpinned)
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12
• Reference 13

Arrival evidence (#464, product redact-secret#972; #860 handoff nvidia.md, READY with an open-ended body). T1: the prefix is NVIDIA docs ("typically start with nvapi-") and the ngcsdk constant with an executing startswith (R1, R6); the alphabet and the floor of 60 are a provider-authored secret-scanning rule in an NVIDIA-owned organization (R2; the handoff checked that it is not a verbatim copy of a public scanner rule), and a second NVIDIA rule uses a lower floor of 40 with the same class. No provider source states an exact width. POLICY, not T1: the 128-byte upper bound (a bounded run for streaming; an over-cap run is rejected whole, never truncated), so positives reach 128 and nothing asserts silence on 129. The peers disagree with the provider grammar in both directions: trufflehog 3.97.4 NVAPI is an exact 64 and so lags on 60-63 and 65-128 while agreeing at 64, and betterleaks is {60,70} (unpinned, T2). Excluded: the legacy prefixless 84-character NGC key (the $oauthtoken registry password; generic context only), nvapi- + fewer than 60 bytes (NVAPI SDK and crate names, short fixtures), nvapi-... and nvapi-xxxx placeholders, and bodies containing a dot (only one looser NVIDIA rule admits it; the trailing boundary rejects the run rather than truncating it). Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1037).