Skip to content
Benchmarks

redact-secret · Report

API key (bb_live_)

bb_live_ + at least 20 [A-Za-z0-9], open-ended (provider CI gate, R2); the 128-byte cap is product policy; bb_test_ is issuance-gated and excluded.

  • Browserbase
  • Detectors: browserbase-api-key
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT1 · Provider-documented
  • Dossier researched2026-09-28
Beta.12 arrival family browserbase-api-key (#464, product redact-secret#973), contract in benchmarks/lib/beta8/464d.ts from the #860 handoff browserbase.md. T1 on the prefix, alphabet and floor; the cap is policy. Neither pinned scanner has a Browserbase rule. Since the 4fb7882 re-pin the product detector is in the pinned registry, so the row maps to it.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-28

4 events in the review history: 3 observed, 1 reviewed. Latest: observed on 2026-10-03 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^bb_live_[A-Za-z0-9]{20,}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
prefix bb_live_, then at least 20 alphanumeric characters [A-Za-z0-9], open-ended; boundaries on both sides. The 128-byte upper bound is product policy. bb_test_ is excluded.
Basis
prefix T1 (docs placeholders bb_live_... under R4 and a provider redaction regex in browserbase/stagehand under R2); alphabet and the floor of 20 T1 under R2 (a provider-authored CI hygiene gate in browserbase/cookbook, 2026-09-25, whose author is a public Browserbase-organization member; no public scanner has a Browserbase rule). The stagehand redactor also admits _ and -; the contract keeps the gate's alphanumeric class.
Issuance
not attempted; one issued bb_live_ key, and whether a bb_test_ key can be created, would narrow it.
Contract in core
detector-families.md (no row until the Beta.12 detector, redact-secret#973, is merged).

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
38
Left readable
0
Redacted too much
0
False alarms
0

38 fixtures: 16 expect a redaction, 22 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T1Provider-documented16000
T2Tool-corroborated6000
T3Project policy16000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it381510
gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it38700
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped38000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it381600

Benchmark dossier questions

Things the sources do not settle. They are listed so nobody reads them as settled.
Open caveat
the 128-byte cap is project policy; a key whose body contains _ or - is an accepted false negative; every bb_test_ key is outside the family.

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
bb_live_session_… and other snake_case identifiers (the glued _ rejects), bb_<timestamp> cookie names and project-ID UUIDs are not keys. The two provider rules disagree on a glued -; the handoff decides both.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

No peer rule maps to this family

None of the reviewed peer scanners has a rule that can match a credential of this family.

None mapped

38 of 38 rows

Fixtures in this family

38 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in API key (bb_live_)
FixtureKind and evidenceredact-secret
browserbase-api-key-bare-prosebrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-bearer-headerbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-chat-pastebrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-dotenvbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-exportbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-json-api-keybrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-json-tokenbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-key-shape-barebrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-key-shape-quotedbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-key-shape-unicode-crlfbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-mcp-envbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-python-sdkbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-sdk-kwargbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-stagehand-tsbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-x-api-key-headerbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-x-bb-api-key-headerbrowserbase · documented-format-literalMust redactT1 · Provider-documentedRedacted
browserbase-api-key-actions-secret-referencebrowserbase · templated-referenceMust not flagT3 · Project policyQuiet
browserbase-api-key-body-19-twinbrowserbase · wrong-lengthMust not flagT3 · Project policy · twinQuiet
browserbase-api-key-ellipsis-placeholderbrowserbase · documentation-placeholderMust not flagT3 · Project policyQuiet
browserbase-api-key-env-reference-referencebrowserbase · templated-referenceMust not flagT3 · Project policyQuiet
browserbase-api-key-hyphen-prefix-twinbrowserbase · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
browserbase-api-key-key-guidance-prosebrowserbase · prose-mentionMust not flagT3 · Project policyQuiet
browserbase-api-key-label-prosebrowserbase · benign-lookalikeMust not flagT3 · Project policyQuiet
browserbase-api-key-leading-glue-twinbrowserbase · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
browserbase-api-key-leading-underscore-twinbrowserbase · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
browserbase-api-key-live-session-identifier-near-missbrowserbase · format-near-missMust not flagT3 · Project policyQuiet
browserbase-api-key-maskbrowserbase · benign-lookalikeMust not flagT3 · Project policyQuiet
browserbase-api-key-prefix-at-eol-near-missbrowserbase · format-near-missMust not flagT2 · Tool-corroboratedQuiet
browserbase-api-key-prefix-onlybrowserbase · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
browserbase-api-key-project-id-public-idbrowserbase · public-identifierMust not flagT3 · Project policyQuiet
browserbase-api-key-referencebrowserbase · benign-lookalikeMust not flagT3 · Project policyQuiet
browserbase-api-key-short-bodybrowserbase · benign-lookalikeMust not flagT3 · Project policyQuiet
browserbase-api-key-timestamp-cookie-public-idbrowserbase · public-identifierMust not flagT3 · Project policyQuiet
browserbase-api-key-trailing-hyphen-twinbrowserbase · boundary-violationMust not flagT3 · Project policy · twinQuiet
browserbase-api-key-trailing-underscore-twinbrowserbase · boundary-violationMust not flagT3 · Project policy · twinQuiet
browserbase-api-key-uppercase-prefix-twinbrowserbase · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
browserbase-api-key-x-run-placeholderbrowserbase · documentation-placeholderMust not flagT3 · Project policyQuiet
browserbase-api-key-your-api-key-here-placeholderbrowserbase · documentation-placeholderMust not flagT3 · Project policyQuiet

Sources

Researched 2026-09-28.

Documentation and code

  • github.com/browserbase/cookbook/blob/eff9eca8e61e16ea1635e9e75e043c7a765c5f88/scripts/verify.py#L383
  • github.com/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/860/browserbase.md
  • github.com/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/860/issuance-research/browserbase.md

Research log