redact-secret · Report
Bot token
Three-segment base64url bot token.
Research record
From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
3 events in the review history: 1 authored, 1 observed, 1 reviewed. Latest: authored on 2026-10-03 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.
Format
Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.
What it looks like
- Descriptive pattern
^(?:[A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}|[A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{38}|[A-Za-z0-9_-]{26}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{38})$
Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.
Format facts
Provider documented ·
mutable-property-source· current · observed 2026-09-24Documentation for the one property varied in legacy twin fixtures (three base64url segments: 24|26 . 6 . 27|38): Un-probeable record lifted 2026-09-24 (#207): twins mutate only segment widths no issued shape has (segment 3 of 37, segment 1 of 25), the dot delimiter, and a byte outside the base64url alphabet. The widths rest on community and dated empirical reports plus TruffleHog's 24/6/27 rule, never on Discord documentation, so every twin stays T2.
- github.com/redact-secret/redact-secret/issues/646provider-documentation · last read 2026-09-24 · latest outcome read · supports Un-probeable record lifted 2026-09-24 (#207): twins mutate only segment widths no issued shape has (segment 3 of 37, segment 1 of 25), the dot delimiter, and a byte outside the base64url alphabet. The widths rest on community and dated empirical reports plus TruffleHog's 24/6/27 rule, never on Discord documentation, so every twin stays T2.
Unresolved ·
tool-corroboration· current · observed 2026-09-22Pinned scanner rules are consistent with the contract grammar (1 artifact: trufflehog 3.97.4).
- trufflesecurity/trufflehog @ v3.97.4: pkg/detectors/discordbottoken/discordbottoken.goscanner-rule-source · last read 2026-09-22 · latest outcome read · supports trufflehog 3.97.4: discordbottoken/discordbottoken
Unresolved ·
field-segments· current · observed 2026-09-22segments: three base64url segments joined by two dots, no = padding
- github.com/redact-secret/redact-secret/issues/646provider-documentation · last read 2026-09-24 · latest outcome read · supports segments: three base64url segments joined by two dots, no = padding
Unresolved ·
field-segment-1· current · observed 2026-09-22segment 1: base64url of the bot user id as decimal ASCII: 24 characters for an 18-digit id, 26 for a 19-digit id (every bot created since 2022-07-22)
- github.com/redact-secret/redact-secret/issues/646provider-documentation · last read 2026-09-24 · latest outcome read · supports segment 1: base64url of the bot user id as decimal ASCII: 24 characters for an 18-digit id, 26 for a 19-digit id (every bot created since 2022-07-22)
Unresolved ·
field-segment-2· current · observed 2026-09-22segment 2: 6 characters (a timestamp)
- trufflesecurity/trufflehog @ v3.97.4: pkg/detectors/discordbottoken/discordbottoken.goscanner-rule-source · last read 2026-09-22 · latest outcome read · supports segment 2: 6 characters (a timestamp)
Unresolved ·
field-segment-3· current · observed 2026-09-22segment 3: 27 characters before about May 2022, 38 since; older tokens keep 27 until reset
- github.com/redact-secret/redact-secret/issues/646provider-documentation · last read 2026-09-24 · latest outcome read · supports segment 3: 27 characters before about May 2022, 38 since; older tokens keep 27 until reset
Tool corroborated ·
dossier-research· current · observed 2026-09-24Legacy dossier research (verdict ready, tier T2) cited 4 sources; the dossier does not attribute sources to individual properties.
- docs.discord.com/developers/referenceprovider-documentation · last read 2026-09-24 · latest outcome read · supports Cited by the legacy dossier research for this family
- discord/discord-api-docs @ 0eb810206eecc4562899c4c9ca2bd2d354e31e25: developers/reference.mdxother · last read 2026-09-24 · latest outcome read · supports Cited by the legacy dossier research for this family
- discord-net/Discord.Net @ d34a50eeabb39699a2329fbdac735b7d2b069824: src/Discord.Net.Core/Utils/TokenUtils.csother · last read 2026-10-03 · latest outcome unchanged · supports Cited by the legacy dossier research for this family
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/646/README.mdproject-research-note · last read 2026-09-24 · latest outcome read · supports Final research evidence recorded by the legacy dossier
Open questions
No open question is recorded for this revision.
Benchmark dossier notes
From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
- Shape
- three base64url segments joined by two dots, no padding. Segment 1 is the base64url of the bot user id in decimal ASCII (24 characters for an 18-digit id, 26 for a 19-digit id, the latter for bots created since 2022-07-22). Segment 2 is 6 characters. Segment 3 is 27 characters for tokens issued before about May 2022 and 38 since; old tokens keep 27 until reset. Alphabet
[A-Za-z0-9_-]. - Basis
- the only provider-domain evidence is the API reference's example header, measured 24/6/27 (legacy shape); an example is not a grammar, so T1 is not met. T2 corroboration: Discord.Net token utilities (segment 1 decodes to a ulong id, no padding), detect-secrets, sif, botstrap and TruffleHog (legacy branch only, keyword-gated). The 38-character segment and 26-character head rest on dated community reports and third-party regexes, and neither pinned peer scanner covers them. Discord gives no stability guarantee.
- Issuance
- not attempted. A fresh token (expected 26/6/38 for a new application) is the open empirical check.
- Contract in core
- detector-families.md; evidence #646 record. The three-shape acceptance was added in redact-secret#670.
In this benchmark
Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
- Fixtures
- 46
- Left readable
- 0
- Redacted too much
- 0
- False alarms
- 0
46 fixtures: 24 expect a redaction, 22 must stay quiet. See every row
| Evidence level | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| T1Provider-documented | 1 | 0 | 0 | 0 |
| T2Tool-corroborated | 32 | 0 | 0 | 0 |
| T3Project policy | 13 | 0 | 0 | 0 |
Every scanner on the same fixtures
In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.
| Scanner | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engine1 rule targets it | 46 | 8 | 0 | 1 |
| gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it | 46 | 12 | 0 | 1 |
| redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped | 46 | 0 | 0 | 0 |
| trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabled1 rule targets it | 46 | 24 | 0 | 0 |
Benchmark dossier questions
Things the sources do not settle. They are listed so nobody reads them as settled.
- Open caveat
- Discord documents no grammar (one legacy-shape example only); the 26/6/38 and 24/6/38 widths rest on dated empirical reports and third-party code; no freshly issued token has been measured.
Looks like it, but isn't
Values the dossier records as resembling this credential without being one.
- Collisions
- none with a fixed prefix; the shape is three dotted base64url runs, so ordinary dotted identifiers and other JWT-like values are the confusable class. detect-secrets additionally requires the first character to be M, N or O, which follows from base64 of a digit string.
Scanner rules for this family
Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
| Scanner | Rule | What the rule matches |
|---|---|---|
| flare-redact · rules 1.6.1 | discord_bot_token | M, N or O + 23 . 6 . 27 characters |
| trufflehog · rules 3.97.4 | discordbottoken | discord keyword + 24.6.27 character segments |
No rule maps to this family in gitleaks, openredaction.
Fixtures in this family
46 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
| Fixture | Kind and evidence | redact-secret |
|---|---|---|
discord-bot-token-actions-envdiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-bomdiscord · multibyte-text-offsets | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-bot-authorizationdiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-client-rundiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-compose-envdiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-config-jsondiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-envdiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-interactions-public-key-public-iddiscord · public-identifier | Must not flagT1 · Provider-documented | Quiet |
discord-bot-token-jsondiscord · structured-text-value | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-markdowndiscord · markdown-and-comment-value | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-no-final-newlinediscord · value-at-input-edges | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-pythondiscord · source-code-string-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-short-hmac-json-twindiscord · wrong-length | Must not flagT3 · Project policy · twin | Quiet |
discord-bot-token-single-quotesdiscord · quoted-value-extent | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-startup-logdiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-three-segments-barediscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-three-segments-current-new-bot-barediscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-three-segments-current-new-bot-quoteddiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-three-segments-current-new-bot-unicode-crlfdiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-three-segments-current-reset-bot-barediscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-three-segments-current-reset-bot-quoteddiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-three-segments-current-reset-bot-unicode-crlfdiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-three-segments-quoteddiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-three-segments-unicode-crlfdiscord · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-tomldiscord · structured-text-value | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-yamldiscord · structured-text-value | Must redactT2 · Tool-corroborated | Redacted |
discord-bot-token-actions-secret-referencediscord · templated-reference | Must not flagT3 · Project policy | Quiet |
discord-bot-token-application-id-public-iddiscord · public-identifier | Must not flagT3 · Project policy | Quiet |
discord-bot-token-bang-hmac-twindiscord · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
discord-bot-token-bang-id-twindiscord · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
discord-bot-token-dash-delimiter-twindiscord · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
discord-bot-token-encoded-user-id-encoded-valuediscord · benign-encoded-value | Must not flagT2 · Tool-corroborated | Quiet |
discord-bot-token-label-prosediscord · benign-lookalike | Must not flagT3 · Project policy | Quiet |
discord-bot-token-maskdiscord · benign-lookalike | Must not flagT3 · Project policy | Quiet |
discord-bot-token-missing-segmentdiscord · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
discord-bot-token-plus-timestamp-twindiscord · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
discord-bot-token-referencediscord · benign-lookalike | Must not flagT3 · Project policy | Quiet |
discord-bot-token-reset-note-prosediscord · prose-mention | Must not flagT3 · Project policy | Quiet |
discord-bot-token-short-current-final-segmentdiscord · benign-lookalike | Must not flagT3 · Project policy | Quiet |
discord-bot-token-short-current-first-segmentdiscord · benign-lookalike | Must not flagT3 · Project policy | Quiet |
discord-bot-token-short-final-segmentdiscord · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
discord-bot-token-short-hmac-twindiscord · wrong-length | Must not flagT3 · Project policy · twin | Quiet |
discord-bot-token-short-id-segment-twindiscord · wrong-length | Must not flagT3 · Project policy · twin | Quiet |
discord-bot-token-underscore-delimiter-twindiscord · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
discord-bot-token-user-mention-public-iddiscord · public-identifier | Must not flagT3 · Project policy | Quiet |
discord-bot-token-your-token-here-placeholderdiscord · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
Sources
Researched 2026-09-24.
Documentation and code
- docs.discord.com/developers/reference
- github.com/discord/discord-api-docs/blob/0eb810206eecc4562899c4c9ca2bd2d354e31e25/developers/reference.mdx
- github.com/discord-net/Discord.Net/blob/d34a50eeabb39699a2329fbdac735b7d2b069824/src/Discord.Net.Core/Utils/TokenUtils.cs
Research log
- redact-secret/redact-secret#646Research issue
- redact-secret/redact-secret#670Research issue
- redact-secret/redact-secret-benchmarks#159Research issue
- redact-secret/redact-secret-benchmarks#128Research issue
- Final evidence, pinned to a commit/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/646/README.md