Skip to content
Benchmarks

redact-secret · Report

Personal access token (xapt-)

xapt- + a lowercase-hex UUID (41 in all), used with an org id; full console and API access.

  • Axiom
  • Detectors: axiom-personal-token
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT1 · Provider-documented
  • Dossier researched2026-09-29
Beta.12 arrival family axiom-personal-token (#528, product redact-secret#1035), contract in benchmarks/lib/beta8/528j.ts from the #1014 handoff axiom.md. T1 (SDK runtime check R6; R5 layout). Shares the axiom-token detector (finding type axiom_personal_token). Neither pinned scanner has an Axiom rule. Since the 4fb7882 re-pin (product PR #1039) it is an arrival family scored by that finding type (scanners/families.mjs arrivalFindingTypes), so the row maps to its own id.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-29

3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-29 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^xapt-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
xapt- + a lowercase-hex UUID (41 in all), used with an org id.
Basis
prefix T1 under R6 and the docs; layout by the shared SDK fixture layout (R5).
Issuance
recommended, as for the API token.
Contract in core
detector-families.md (row on main; the Beta.12 detector, redact-secret#1035, merged in redact-secret#1039 and is unreleased).

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
25
Left readable
0
Redacted too much
0
False alarms
0

25 fixtures: 11 expect a redaction, 14 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T1Provider-documented11000
T2Tool-corroborated9000
T3Project policy5000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it251010
gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it25300
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped25000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it251100

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
as for the API token.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

No peer rule maps to this family

None of the reviewed peer scanners has a rule that can match a credential of this family.

None mapped

25 of 25 rows

Fixtures in this family

25 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in Personal access token (xapt-)
FixtureKind and evidenceredact-secret
axiom-personal-token-bare-proseaxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-bearer-headeraxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-chat-pasteaxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-cli-configaxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-dotenvaxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-exportaxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-json-api-keyaxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-json-tokenaxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-org-id-pairaxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-sdk-kwargaxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-x-api-key-headeraxiom · documented-format-literalMust redactT1 · Provider-documentedRedacted
axiom-personal-token-actions-secret-referenceaxiom · templated-referenceMust not flagT3 · Project policyQuiet
axiom-personal-token-ellipsis-placeholderaxiom · documentation-placeholderMust not flagT3 · Project policyQuiet
axiom-personal-token-env-reference-referenceaxiom · templated-referenceMust not flagT3 · Project policyQuiet
axiom-personal-token-leading-glue-twinaxiom · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
axiom-personal-token-long-last-group-twinaxiom · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
axiom-personal-token-missing-hyphen-twinaxiom · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
axiom-personal-token-org-id-header-public-idaxiom · public-identifierMust not flagT2 · Tool-corroboratedQuiet
axiom-personal-token-token-guidance-proseaxiom · prose-mentionMust not flagT3 · Project policyQuiet
axiom-personal-token-trace-id-uuid-public-idaxiom · public-identifierMust not flagT2 · Tool-corroboratedQuiet
axiom-personal-token-trailing-hyphen-twinaxiom · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
axiom-personal-token-truncated-near-missaxiom · format-near-missMust not flagT2 · Tool-corroboratedQuiet
axiom-personal-token-underscore-separator-twinaxiom · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
axiom-personal-token-uppercase-hex-byte-twinaxiom · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
axiom-personal-token-your-personal-token-placeholderaxiom · documentation-placeholderMust not flagT3 · Project policyQuiet

Sources

Researched 2026-09-29.

Documentation and code

  • github.com/axiomhq/axiom-go/blob/ae983c9447003f74f00e55a2ca64ea119b558fb8/internal/config/token.go#L7-L18
  • github.com/redact-secret/redact-secret/blob/4f220ea000b58fa2e0e431ad88dea4eccb393fb0/docs/audits/evidence/1014/axiom.md

Research log

Other Axiom families