RubyGems API keys

• Provider documentation rubygems/rubygems.org app/controllers/concerns/api_keyable.rb (d4cfcc9, last changed 2026-03-03): generate_rubygems_key returns "rubygems_#{SecureRandom.hex(24)}"; re-checked 2026-09-29 · observed 2026-09-29 · rubygems_ + exactly 48 lowercase hex (24 random bytes), 57 in all; no checksum
• gitleaks 8.30.1
• trufflehog 3.97.4
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8

Arrival evidence (#528, product redact-secret#1023; #1014 handoff rubygems.md, READY). A key can push and yank gems and manage owners within its scopes, so a leak is a supply-chain risk for every gem the account owns. T1 for the prefix, the 48-byte length and the lowercase-hex alphabet under R1, from the provider's own generator; OIDC-exchanged keys share it. RubyGems sends the key in Authorization without a scheme. Excluded: legacy unprefixed keys (no shape; generic context covers GEM_HOST_API_KEY= and :rubygems_api_key:), rubygems_version and rubygems_mfa_required metadata keys (they fail the body) and uppercased copies. gitleaks 8.30.1 agrees with the grammar but also requires a trailing delimiter; trufflehog 3.97.4 reads a wider class (any lowercase letter and A), so it overreaches on a non-hex letter twin. Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1039).