vercel-personal-access-token

• kingfisher
• betterleaks
• CredSweeper
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12
• Reference 13
• Reference 14
• Reference 15
• Reference 16

Scored arrival family (#1013 READY-T2; product redact-secret#1036, which types it as vercel_personal_access_token inside vercel-token). The personal access token (acts as the user, account-wide within its scope). The vcp_ marker is T1 (Vercel changelog and docs); the body is T2: CLI --token/VERCEL_TOKEN example: one vcp_ + 56 alphanumeric value, hand-written (fails the checksum), plus three peer owners (kingfisher, betterleaks, CredSweeper). No Vercel code generates or validates a length, alphabet or checksum; Vercel code only discriminates by prefix. The body alphabet leaves _ and - out (every provider example and CredSweeper; the kingfisher/betterleaks rules and Vercel's own masking regexes admit them, maskers are not validators), bounded by the record, not settled. The 50 + 6 base62 CRC-32 tail is provider-backed on one vca_ value and the OpenAPI "token checksum suffix" only, and the CLI vcp_ example fails it, so it is recorded unresolved and never enforced: positives carry a matching and a mismatching tail. Excluded: the legacy unprefixed 24-character token, the masked filler, vci_ and vck_ (STILL-BLOCKED, ruling Q-VC) and the vercel:access-token compatibility aggregate.