Travis CI API tokens

• gitleaks 8.30.1
• trufflehog 3.97.4
• Reference 1
• Twin source Authorization: token header, token from travis token · observed 2026-09-24 · the provider documents the API token as generated by the travis CLI (travis token, travis token --pro) and sent in an Authorization: token header to api.travis-ci.org / api.travis-ci.com; the example is masked (xxxxxxxxxxxx) and no length or alphabet is stated. Context twins keep the token and remove the same-line Travis context, or rename the key to a Travis identifier name

Registry detector travisci-api-token since redact-secret#523 (#773, registry pinned at 3144bb3); authored under #259 directly as a context-gated registry contract. Travis CI states no token shape. Both pinned peers corroborate a 22-character alphanumeric token gated on a travis keyword: gitleaks 8.30.1 travisci-access-token (a case-insensitive travis keyword before an assignment operator, then [a-z0-9]{22} under (?i)) and trufflehog 3.97.4 travisci (a travis prefix within its keyword window, then \b[a-zA-Z0-9_]{22}\b). The contract freezes their intersection, [A-Za-z0-9]{22}, recognised only beside a same-line travis keyword, so positives score as policy. It also requires at least one letter and one digit, matching the product grammar; about 2% of uniformly random 22-character tokens have no digit and fall outside that claim. The underscore trufflehog admits is not claimed, and the underscore twin records that peer difference. Travis build, job and repository ids are numeric and commit SHAs are 40 hex characters, so they are public-id controls. .travis.yml secure: values are RSA ciphertext and are encoded-value controls.