Pinecone API keys

• trufflehog 3.97.4
• Reference 1

Graduated arrival contract (registry detector since redact-secret#730). Lexical separability decided before authoring (#212): the pcsk_ prefix with a label segment and a 63-character secret segment separates a current key from every recorded confusable (UUID key/project/service-account ids, index hosts, environment names, masked pcsk*** values). The pcsk_ prefix and the <label>_<secret> segmenting come from provider code (Pinecone CLI help, Python SDK unit tests, the pinecone-io/skills guidance), not provider documentation; the 5-6 label width and 63-character secret come from peer rules (trufflehog 3.97.4 pinecone; betterleaks pinecone-api-key.2, which likely shares its grammar), hence T2. benchmarks/detector-inventory.json records the trufflehog detector as feature-gated (PineconeDetectorEnabled), yet the pinned 3.97.4 filesystem scan reported every pcsk_ positive in this corpus's first run (2026-09-24); that inventory contradiction is recorded, not resolved here. Contradiction kept open: Pinecone's Admin API documentation and generated SDK models describe new keys as pckey_<public-label>_<unique-key>, a prefix no tool, code sample or observation shows. No fixture asserts silence on pckey_. Legacy bare-UUID keys are the separate context-gated pinecone-api-key-legacy family; service-account client secrets are another credential class and are not controls.