Skip to content
Benchmarks

redact-secret · Report

Deployment, project and admin key (hex body)

An optional prod:/dev: + cloud name or preview:/project: + two slugs lead, the deployment or instance name, one |, then 01 + an even 74–96 lowercase hex body; the whole key is the credential. The cloud eyJ2 deploy-key body is issuance-gated and not claimed.

  • Convex
  • Detectors: convex-deployment-key
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT1 · Provider-documented
  • Dossier researched2026-09-28
Registry detector convex-deployment-key since redact-secret#912 (registry pinned at 1127bf9); graduated from a Beta.11 arrival family (#436), contract in benchmarks/lib/beta8/436a.ts. T1 on provider backend code (R1); neither pinned scanner has a Convex rule.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-28

3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-28 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^(?:(?:prod|dev):[a-z]+-[a-z]+-[0-9]+|(?:preview|project):[a-z0-9][a-z0-9-]{0,62}:[a-z0-9][a-z0-9-]{0,62}|[a-z0-9][a-z0-9-]{0,62})\|01(?:[0-9a-f]{2}){36,47}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Basis
T1 for the type lead, separator and hex body from provider code in get-convex/convex-backend (key format, keybroker encryptor with version byte 1, nonce and tag, CLI regexes); the hex length band is derived from the generator (R1), not stated. The docs page shows truncated typed examples.
Issuance
not attempted; structure-only check for the cloud body is the highest-value one named in the Tier B re-rank.
Contract in core
detector-families.md; handoff and issuance research linked below.

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
41
Left readable
0
Redacted too much
0
False alarms
0

41 fixtures: 16 expect a redaction, 25 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T1Provider-documented16000
T2Tool-corroborated17000
T3Project policy8000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it411600
gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it411600
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped41000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it411600

Benchmark dossier questions

Things the sources do not settle. They are listed so nobody reads them as settled.
Open caveat
Hex-body keys only. The cloud eyJ2 body (Base64 alphabet, padding, length) is ISSUANCE-GATED (R4; still gated after the 2026-09-28 issuance research); needs a structure-only issuance check.

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
CONVEX_DEPLOYMENT=dev:<name> and *.convex.cloud URLs are public selectors with no |. The pre-0.16.0 bare legacy key has no anchor. The name-only bearer-token partial span was a generic defect, fixed under #918. #919 later made the exact names CONVEX_DEPLOY_KEY and CONVEX_SELF_HOSTED_ADMIN_KEY a contextual finding, so a gated eyJ2 body under those names is redacted. A preview deployment key can also read preview:<branch-name>| with a name up to 40 characters (: and | mapped to _); that can fall outside the bounded class and is an accepted false negative (issuance research).

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

No peer rule maps to this family

None of the reviewed peer scanners has a rule that can match a credential of this family.

None mapped

41 of 41 rows

Fixtures in this family

41 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in Deployment, project and admin key (hex body)
FixtureKind and evidenceredact-secret
convex-deployment-key-actions-deployconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-bare-proseconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-bearer-headerconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-chat-pasteconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-compose-self-hostedconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-curl-authorization-convexconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-dotenvconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-exportconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-json-api-keyconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-json-tokenconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-key-shape-bareconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-key-shape-quotedconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-key-shape-unicode-crlfconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-mcp-envconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-sdk-kwargconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-x-api-key-headerconvex · documented-format-literalMust redactT1 · Provider-documentedRedacted
convex-deployment-key-actions-secret-referenceconvex · templated-referenceMust not flagT3 · Project policyQuiet
convex-deployment-key-adjective-animal-placeholderconvex · documentation-placeholderMust not flagT3 · Project policyQuiet
convex-deployment-key-body-72-twinconvex · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
convex-deployment-key-body-98-twinconvex · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
convex-deployment-key-body-variable-referenceconvex · templated-referenceMust not flagT3 · Project policyQuiet
convex-deployment-key-deployment-selector-public-idconvex · public-identifierMust not flagT2 · Tool-corroboratedQuiet
convex-deployment-key-deployment-urls-public-idconvex · public-identifierMust not flagT2 · Tool-corroboratedQuiet
convex-deployment-key-digest-after-pipe-encoded-valueconvex · benign-encoded-valueMust not flagT2 · Tool-corroboratedQuiet
convex-deployment-key-docs-name-and-key-placeholderconvex · documentation-placeholderMust not flagT3 · Project policyQuiet
convex-deployment-key-double-separator-twinconvex · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
convex-deployment-key-g-in-body-twinconvex · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
convex-deployment-key-key-guidance-proseconvex · prose-mentionMust not flagT3 · Project policyQuiet
convex-deployment-key-label-proseconvex · benign-lookalikeMust not flagT3 · Project policyQuiet
convex-deployment-key-maskconvex · benign-lookalikeMust not flagT3 · Project policyQuiet
convex-deployment-key-odd-length-body-twinconvex · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
convex-deployment-key-prefix-onlyconvex · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
convex-deployment-key-prod-selector-public-idconvex · public-identifierMust not flagT2 · Tool-corroboratedQuiet
convex-deployment-key-referenceconvex · benign-lookalikeMust not flagT3 · Project policyQuiet
convex-deployment-key-short-bodyconvex · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
convex-deployment-key-space-before-separator-twinconvex · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
convex-deployment-key-table-cell-near-missconvex · format-near-missMust not flagT2 · Tool-corroboratedQuiet
convex-deployment-key-trailing-glue-twinconvex · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
convex-deployment-key-underscore-name-twinconvex · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
convex-deployment-key-uppercase-hex-byte-twinconvex · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
convex-deployment-key-version-02-twinconvex · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet

Sources

Researched 2026-09-28.

Documentation and code

  • docs.convex.dev/cli/deploy-key-types
  • github.com/get-convex/convex-backend/blob/032e81e264a8b23b8d566d8f83f773d2bfbedb88/crates/common/src/types/admin_key.rs
  • github.com/get-convex/convex-backend/tree/032e81e264a8b23b8d566d8f83f773d2bfbedb88

Research log