W&B API keys

• Provider documentation wandb SDK validation.py at 98f93d6 ([\w-]+, 40+; "may only contain the letters A-Z, digits and underscores"), the wandb_v1_ weave-claude-code test constant (R5), #10688 test keys of 86, docs "about 86 characters" (re-checked 2026-09-28) · observed 2026-09-28 · wandb_v1_ + [A-Za-z0-9_] to about 86 in all; every provider test fixture of a new key is exactly 86; no separator is required
• trufflehog 3.97.4
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12

Arrival evidence (#436, product redact-secret#917; #860 handoff wandb.md, READY for wandb_v1_). T1: the prefix is a W&B-authored test constant (R5), the [A-Za-z0-9_] alphabet is the SDK validator and its error text (R1), and the docs say new keys are "about 86 characters", which every provider test fixture of a new key (wandb#10688, Weave #5732) makes exactly 86. By the orchestrator decision on redact-secret#917 the product matches a bounded tolerant range around 86 until an issuance check, so positives carry totals 85, 86 and 87 and no fixture asserts silence on any length. The 27/_/49 split is scanner-only (T2) and not required: positives carry it and a body without an inner _. On-prem keys are <host>-<key>; the host label is public and is authored as an envelope around the key, so a finding with or without it passes. Excluded: the legacy 40-hex key (generic context), client JWTs (jwt), OIDC identity-token files, wandb_v1_ placeholders, and a future wandb_v2_ (unknown, so never asserted). Graduated to a registry detector at the 1127bf9 re-pin (redact-secret PR #938).