Pulumi access tokens

• Provider documentation pul- prefixed opaque token · observed 2026-09-21 · Pulumi's own Cloud REST API reference states, of the token-creation response: "The response includes the token ID and the tokenValue (prefixed with 'pul-')." Its personal-access-tokens sibling page carries the identical sentence. Neither page states a length or alphabet for the value that follows the prefix
• trufflehog 3.97.4
• gitleaks 8.30.1

Body length and alphabet are tool-corroborated, not provider-documented: gitleaks 8.30.1's pulumi-api-token rule and trufflehog 3.97.4's pulumi detector independently pin exactly 40 lowercase hexadecimal bytes after the prefix; neither registers any other length or alphabet, so this contract asserts none. Both tools pin the body to exactly 40 bytes rather than a floor, so a 39- or 41-byte body is an intentional false negative. github.com/plenoai/pleno-dlp, the second tool the product ADR cites for this family, is not one of this suite's pinned scanners and is recorded here only as prose, never as a pinned corroboration entry. All three token kinds (personal, organization, team) share this one prefix and body shape; Pulumi's own REST API reference documents no kind-specific prefix.