redact-secret · Report
Inference API key (csk-)
csk- or csk_ + exactly 48 body bytes (52 in all): the length is the provider validator (R1) and the prefixes a dated staff statement (R3); the [A-Za-z0-9_-] alphabet is project policy under R10. Management API keys are a separate credential of unknown shape.
Beta.12 arrival family cerebras-api-key (#464, product redact-secret#975), contract in benchmarks/lib/beta8/464e.ts from the #860 handoff cerebras.md. T1 on length and prefixes; the alphabet is policy (R10). Neither pinned scanner has a Cerebras rule; unpinned tool rules use [a-z0-9]. The leading boundary keeps Pinecone pcsk_ out. Since the 4fb7882 re-pin the product detector is in the pinned registry, so the row maps to it.
Research record
From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-28 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.
Format
Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.
What it looks like
- Descriptive pattern
^csk[-_][A-Za-z0-9_-]{48}$
Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.
Format facts
Provider documented ·
provider-source· current · observed 2026-09-29Cerebras/vscode-cerebras-chat src/provider.ts (e03602f; the check was introduced on 2025-08-29 with csk- only and the 52 has stayed): a key that does not start csk_ or csk- or whose length is not 52 is rejected; a Cerebras staff member wrote on 2025-10-23 and 2025-10-24 that customers hold keys with both prefixes, csk_ was an unintentional recent change, new keys use csk-, and both should be accepted (R3); re-checked 2026-09-28: csk- or csk_ + exactly 48 body bytes (52 in all); the body alphabet is project policy under R10, not a provider fact
- Cerebras/vscode-cerebras-chat @ e03602fa96f3ddfc8122ea2655bfa39424a5d157: src/provider.tsprovider-documentation · last read 2026-09-29 · latest outcome read · supports csk- or csk_ + exactly 48 body bytes (52 in all); the body alphabet is project policy under R10, not a provider fact · #L113
Unresolved ·
tool-corroboration· current · observed 2026-09-29Pinned scanner rules are consistent with the contract grammar (1 artifact: betterleaks and other tool rules (unpinned)).
- github.com/betterleaks/betterleaksscanner-rule-source · last read 2026-09-29 · latest outcome read · supports betterleaks and other tool rules (unpinned): csk- body [a-z0-9] (tool-only, T2; not adopted, R8)
Provider documented ·
field-prefix· current · observed 2026-09-29prefix: csk- (current) or csk_ (the 2025-10 window, still accepted) (The csk_ prefix is T1 as of 2025-10 (R3): a dated staff statement.)
- github.com/Cerebras/vscode-cerebras-chat/pull/8provider-sdk-source · last read 2026-09-29 · latest outcome read · supports staff statement, 2025-10-23 · #discussion_r2453931915
- github.com/Cerebras/vscode-cerebras-chat/pull/8provider-sdk-source · last read 2026-09-29 · latest outcome read · supports staff statement, 2025-10-24 · #discussion_r2462008982
- Cerebras/vscode-cerebras-chat @ e03602fa96f3ddfc8122ea2655bfa39424a5d157: src/provider.tsprovider-documentation · last read 2026-09-29 · latest outcome read · supports starts csk_ or csk- · #L113
- github.com/redact-secret/redact-secret/issues/860issue-or-discussion · last read 2026-09-29 · latest outcome read · supports R1, R3 · #issuecomment-5852413851
Provider documented ·
field-body-length· current · observed 2026-09-29body-length: exactly 48 body bytes (52 in all)
- Cerebras/vscode-cerebras-chat @ 9d0253c1e071dd4d4afaad92cf5a6958bbea80eb: src/provider.tsprovider-sdk-source · last read 2026-09-29 · latest outcome read · supports unchanged 13 months later · #L176
- Cerebras/vscode-cerebras-chat @ e03602fa96f3ddfc8122ea2655bfa39424a5d157: src/provider.tsprovider-documentation · last read 2026-09-29 · latest outcome read · supports length 52 minus the 4-byte prefix · #L113
- github.com/redact-secret/redact-secret/issues/860issue-or-discussion · last read 2026-09-29 · latest outcome read · supports R1 · #issuecomment-5852413851
Unresolved ·
field-policy-alphabet· current · observed 2026-09-29policy-alphabet: POLICY (R10), not T1: the body alphabet is [A-Za-z0-9_-] (The validator accepts any 48 code units and states no alphabet. Positives use lowercase-only bodies and bodies with _ and -; no fixture asserts silence on a byte outside the class, so a dot or plus twin is not authored.)
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/cerebras.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports the policy class is a superset of every class seen
- github.com/redact-secret/redact-secret/issues/860issue-or-discussion · last read 2026-09-29 · latest outcome read · supports R10: project policy may fill a grammar the provider states only partly, never narrower than a provider-stated class · #issuecomment-5880547337
- github.com/redact-secret/redact-secret/issues/860issue-or-discussion · last read 2026-09-29 · latest outcome read · supports R8: no narrowing from third-party rules · #issuecomment-5871306275
Unresolved ·
field-tool-alphabet· current · observed 2026-09-29tool-alphabet: tool rules use [a-z0-9] for the body (Tool-only and narrower than the policy class; not adopted (R8).)
- github.com/betterleaks/betterleaksscanner-rule-source · last read 2026-09-29 · latest outcome read · supports unpinned
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/issuance-research/cerebras.mdscanner-rule-source · last read 2026-09-29 · latest outcome read · supports tool-only
Unresolved ·
field-boundary· current · observed 2026-09-29boundary: a key glued to an identifier before the prefix ([A-Za-z0-9_-]) is not claimed; this keeps Pinecone pcsk_ / pcsk- unclaimed (Handoff boundary decision, not a provider statement. The body class already contains _ and -, so a trailing byte extends the run and no trailing-glue twin exists.)
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/cerebras.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports implementation notes: the leading boundary is what rejects pcsk_
Provider documented ·
field-transport· current · observed 2026-09-29transport: the CEREBRAS_API_KEY environment variable, sent as Authorization: Bearer to api.cerebras.ai; Cerebras(api_key=...)
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/cerebras.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports role and blast radius
Unresolved ·
field-management-key· current · observed 2026-09-29management-key: the Management API key for dedicated endpoints is a separate credential of unknown shape (Not this family; nothing is authored for it.)
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/cerebras.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports excluded shapes
Tool corroborated ·
field-peer-lag· current · observed 2026-09-29peer-lag: no Cerebras rule in trufflehog 3.97.4 or gitleaks 8.30.1; unpinned tool rules use a [a-z0-9] body, narrower than the policy class
- gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports no cerebras rule
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/issuance-research/cerebras.mdscanner-rule-source · last read 2026-09-29 · latest outcome read · supports tool-only [a-z0-9]
- trufflesecurity/trufflehog @ v3.97.4: pkg/detectorsscanner-rule-source · last read 2026-09-29 · latest outcome read · supports no cerebras detector directory at the pinned version
Unresolved ·
listed-references· current · observed 2026-09-29The legacy contract lists 15 references without stating which property each supports.
- github.com/Cerebras/vscode-cerebras-chat/pull/8provider-sdk-source · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #discussion_r2453931915
- github.com/Cerebras/vscode-cerebras-chat/pull/8provider-sdk-source · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #discussion_r2462008982
- github.com/Cerebras/vscode-cerebras-chat/issues/7issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- Cerebras/vscode-cerebras-chat @ 9d0253c1e071dd4d4afaad92cf5a6958bbea80eb: src/provider.tsprovider-sdk-source · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #L176
- Cerebras/vscode-cerebras-chat @ e03602fa96f3ddfc8122ea2655bfa39424a5d157: src/provider.tsprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #L113
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/cerebras.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/README.mdproject-research-note · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret/issues/860issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #issuecomment-5852413851
- github.com/redact-secret/redact-secret/issues/860issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #issuecomment-5871306275
- github.com/redact-secret/redact-secret/issues/860issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #issuecomment-5880547337
- github.com/redact-secret/redact-secret/issues/860issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret-benchmarks/issues/464issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/issuance-research/cerebras.mdscanner-rule-source · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret/issues/975issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/tier-b-rerank.mdproject-research-note · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
Provider documented ·
dossier-research· current · observed 2026-09-28Legacy dossier research (verdict ready, tier T1) cited 3 sources; the dossier does not attribute sources to individual properties.
- Cerebras/vscode-cerebras-chat @ e03602fa96f3ddfc8122ea2655bfa39424a5d157: src/provider.tsprovider-documentation · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family · #L113
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/cerebras.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports Final research evidence recorded by the legacy dossier
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/issuance-research/cerebras.mdscanner-rule-source · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
Provider documented ·
taxonomy-sources· current · observed 2026-09-28The legacy taxonomy lists 2 sources for this family. The taxonomy records no date; the dossier researchedAt is used as the observed-at date.
- Cerebras/vscode-cerebras-chat @ e03602fa96f3ddfc8122ea2655bfa39424a5d157: src/provider.tsprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy · #L113
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/860/cerebras.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy
Open questions
No open question is recorded for this revision.
Benchmark dossier notes
From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
- Shape
- prefix
csk-(current) orcsk_(the 2025-10 window, still accepted), then exactly 48 characters (52 in total). The body alphabet[A-Za-z0-9_-]is project policy under ruling R10, not a provider fact. - Basis
- length T1 under R1 (the provider VS Code extension validator rejects any key not starting
csk_orcsk-or not 52 long; introduced 2025-08-29, unchanged since) and both prefixes T1 under R3 (staff statements on 2025-10-23 and 2025-10-24; provider docs state "starts withcsk-"). No provider source states the alphabet; tool rules say[a-z0-9](tool-only, not adopted, R8). - Issuance
- not attempted; R10 lets project policy fill the alphabet as long as the fill is at least as wide as any provider-stated class.
- Contract in core
- detector-families.md (no row until the Beta.12 detector, redact-secret#975, is merged).
In this benchmark
Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
- Fixtures
- 46
- Left readable
- 0
- Redacted too much
- 0
- False alarms
- 0
46 fixtures: 24 expect a redaction, 22 must stay quiet. See every row
| Evidence level | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| T1Provider-documented | 24 | 0 | 0 | 0 |
| T2Tool-corroborated | 13 | 0 | 0 | 0 |
| T3Project policy | 9 | 0 | 0 | 0 |
Every scanner on the same fixtures
In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.
| Scanner | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it | 46 | 22 | 2 | 0 |
| gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it | 46 | 9 | 0 | 0 |
| redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped | 46 | 0 | 0 | 0 |
| trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it | 46 | 24 | 0 | 0 |
Benchmark dossier questions
Things the sources do not settle. They are listed so nobody reads them as settled.
- Open caveat
- the alphabet is policy (R10), so a tool that follows the
[a-z0-9]rule lags on any uppercase,_or-body; a future length change would be a false negative.
Looks like it, but isn't
Values the dossier records as resembling this credential without being one.
- Collisions
- the leading boundary excludes Pinecone
pcsk_/pcsk-(the byte beforecskisp); Pinecone keepspcsk_with a 69- or 70-byte body, so no width overlaps.
Scanner rules for this family
Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
No peer rule maps to this family
None of the reviewed peer scanners has a rule that can match a credential of this family.
None mapped
Fixtures in this family
46 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
| Fixture | Kind and evidence | redact-secret |
|---|---|---|
cerebras-api-key-bare-prosecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-bare-prose-underscorecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-bearer-headercerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-bearer-header-underscorecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-chat-pastecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-chat-paste-underscorecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-dotenvcerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-dotenv-underscorecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-exportcerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-export-underscorecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-json-api-keycerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-json-api-key-underscorecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-json-tokencerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-json-token-underscorecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-key-shape-barecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-key-shape-quotedcerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-key-shape-unicode-crlfcerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-openai-compat-underscorecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-pinecone-neighbour-dotenvcerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-python-sdkcerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-sdk-kwargcerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-sdk-kwarg-underscorecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-x-api-key-headercerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-x-api-key-header-underscorecerebras · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
cerebras-api-key-actions-secret-referencecerebras · templated-reference | Must not flagT3 · Project policy | Quiet |
cerebras-api-key-body-47-twincerebras · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
cerebras-api-key-body-49-twincerebras · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
cerebras-api-key-dot-separator-twincerebras · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
cerebras-api-key-ellipsis-placeholdercerebras · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
cerebras-api-key-env-reference-referencecerebras · templated-reference | Must not flagT3 · Project policy | Quiet |
cerebras-api-key-key-guidance-prosecerebras · prose-mention | Must not flagT3 · Project policy | Quiet |
cerebras-api-key-label-prosecerebras · benign-lookalike | Must not flagT3 · Project policy | Quiet |
cerebras-api-key-leading-glue-twincerebras · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
cerebras-api-key-leading-underscore-twincerebras · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
cerebras-api-key-maskcerebras · benign-lookalike | Must not flagT3 · Project policy | Quiet |
cerebras-api-key-pinecone-hyphen-glue-twincerebras · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
cerebras-api-key-pinecone-underscore-glue-twincerebras · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
cerebras-api-key-prefix-at-eol-near-misscerebras · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
cerebras-api-key-prefix-onlycerebras · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
cerebras-api-key-referencecerebras · benign-lookalike | Must not flagT3 · Project policy | Quiet |
cerebras-api-key-short-bodycerebras · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
cerebras-api-key-snake-case-name-public-idcerebras · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
cerebras-api-key-truncated-near-misscerebras · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
cerebras-api-key-uppercase-prefix-twincerebras · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
cerebras-api-key-x-run-placeholdercerebras · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
cerebras-api-key-your-key-here-placeholdercerebras · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
Sources
Researched 2026-09-28.
Documentation and code
- github.com/Cerebras/vscode-cerebras-chat/blob/e03602fa96f3ddfc8122ea2655bfa39424a5d157/src/provider.ts#L113
- github.com/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/860/cerebras.md
- github.com/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/860/issuance-research/cerebras.md
Research log
- redact-secret/redact-secret#860Research issue
- redact-secret/redact-secret#975Research issue
- redact-secret/redact-secret-benchmarks#464Research issue
- Final evidence, pinned to a commit/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/860/cerebras.md