vercel-app-refresh-token

• kingfisher
• betterleaks
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12
• Reference 13
• Reference 14
• Reference 15
• Reference 16

Scored arrival family (#1013 READY-T2, thin; product redact-secret#1036, which types it as vercel_app_refresh_token inside vercel-token). The Vercel App refresh token. The vcr_ marker is T1 (Vercel changelog and docs); the body is T2: Sign in with Vercel tokens page: vcr_ + the vca_ example body (no independent vcr_ body), plus two peer owners (kingfisher, betterleaks), both of which copy the provider value. No Vercel code generates or validates a length, alphabet or checksum; Vercel code only discriminates by prefix. The body alphabet leaves _ and - out (every provider example and CredSweeper; the kingfisher/betterleaks rules and Vercel's own masking regexes admit them, maskers are not validators), bounded by the record, not settled. The 50 + 6 base62 CRC-32 tail is provider-backed on one vca_ value and the OpenAPI "token checksum suffix" only, and the CLI vcp_ example fails it, so it is recorded unresolved and never enforced: positives carry a matching and a mismatching tail. Excluded: the legacy unprefixed 24-character token, the masked filler, vci_ and vck_ (STILL-BLOCKED, ruling Q-VC) and the vercel:access-token compatibility aggregate.