redact-secret · Report
Legacy FCM server key
Legacy Firebase Cloud Messaging HTTP/XMPP server key: literal AAAA prefix, 7 bytes, a literal ":", then 140 bytes.
#81 backfilled the firebase-server-key detector (redact-secret#543). Service-account JSON exports and AIza-prefixed keys are covered elsewhere (private-key, google-api-key), not this family.
Research record
From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
4 events in the review history: 3 observed, 1 reviewed. Latest: observed on 2026-10-03 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.
Format
Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.
What it looks like
- Descriptive pattern
^AAAA[A-Za-z0-9_-]{7}:[A-Za-z0-9_-]{140}$
Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.
Format facts
Unresolved ·
tool-corroboration· current · observed 2026-09-20Pinned scanner rules are consistent with the contract grammar (1 artifact: nuclei-templates (projectdiscovery)).
- projectdiscovery/nuclei-templates @ 8cf94b93a389a47bef77b89f8c8915b2755018f0: http/exposures/tokens/firebase-fcm-server-key-disclosure.yamlscanner-rule-source · last read 2026-10-03 · latest outcome unchanged · supports nuclei-templates (projectdiscovery): firebase-fcm-server-key-disclosure.yaml
Unresolved ·
field-head· current · observed 2026-09-22head: literal AAAA plus 7 characters (11 in total): the base64url of the 8-byte big-endian project number, so AAAA holds only while project numbers stay below 2^40
- github.com/redact-secret/redact-secret/issues/649third-party-writeup · last read 2026-09-22 · latest outcome read · supports Head-to-project-number decoding is an aggregate empirical analysis; Google documents no AAAA prefix.
Unresolved ·
field-delimiter· current · observed 2026-09-20delimiter: a single : between head and body
- projectdiscovery/nuclei-templates @ 8cf94b93a389a47bef77b89f8c8915b2755018f0: http/exposures/tokens/firebase-fcm-server-key-disclosure.yamlscanner-rule-source · last read 2026-10-03 · latest outcome unchanged · supports delimiter: a single : between head and body
Unresolved ·
field-body-length· current · observed 2026-09-20body length: exactly 140 characters of [A-Za-z0-9_-] (140 is dominant from 2017 on (58 of 66 observed keys); late-2016 keys carry 162/167/183-character bodies and Google's 2017 blog gives a 175 total. No fixture asserts silence on those lengths.)
- projectdiscovery/nuclei-templates @ 8cf94b93a389a47bef77b89f8c8915b2755018f0: http/exposures/tokens/firebase-fcm-server-key-disclosure.yamlscanner-rule-source · last read 2026-10-03 · latest outcome unchanged · supports body length: exactly 140 characters of [A-Za-z0-9_-]
Unresolved ·
field-body-marker· current · observed 2026-09-22body marker: every observed real body starts APA91b, the prefix FCM registration tokens also use (Positives carry it; the contract does not require it.)
- github.com/redact-secret/redact-secret/issues/649third-party-writeup · last read 2026-09-22 · latest outcome read · supports body marker: every observed real body starts APA91b, the prefix FCM registration tokens also use
Unresolved ·
field-issuance· current · observed 2026-09-22issuance: the legacy FCM API was shut down in June 2024 and no new server key can be issued
- web.archive.org/web/20240602080626/https://firebase.google.com/support/faqprovider-documentation · last read 2026-09-22 · latest outcome read · supports issuance: the legacy FCM API was shut down in June 2024 and no new server key can be issued
Tool corroborated ·
dossier-research· current · observed 2026-09-24Legacy dossier research (verdict ready, tier T2) cited 5 sources; the dossier does not attribute sources to individual properties.
- firebase.google.com/support/releasesprovider-documentation · last read 2026-09-24 · latest outcome read · supports Cited by the legacy dossier research for this family
- firebase.googleblog.com/2017/01/debugging-firebase-cloud-messaging-on.htmlprovider-documentation · last read 2026-10-03 · latest outcome read · supports Cited by the legacy dossier research for this family
- firebase/firebase-js-sdk @ 5ab2fc6f889be5226f44d2e50c7eb20144f69338: integration/messaging/test/utils/sendMessage.jsprovider-sdk-source · last read 2026-09-24 · latest outcome read · supports Cited by the legacy dossier research for this family
- projectdiscovery/nuclei-templates @ 8cf94b93a389a47bef77b89f8c8915b2755018f0: http/exposures/tokens/firebase-fcm-server-key-disclosure.yamlscanner-rule-source · last read 2026-10-03 · latest outcome unchanged · supports Cited by the legacy dossier research for this family
- redact-secret/redact-secret @ 8b6a5fde52ecb4dfce13f09c7a947062d21483c7: docs/audits/evidence/649/README.mdproject-research-note · last read 2026-09-24 · latest outcome read · supports Final research evidence recorded by the legacy dossier
Unresolved ·
taxonomy-sources· current · observed 2026-09-24The legacy taxonomy lists 1 source for this family. The taxonomy records no date; the dossier researchedAt is used as the observed-at date.
- projectdiscovery/nuclei-templates @ 8cf94b93a389a47bef77b89f8c8915b2755018f0: http/exposures/tokens/firebase-fcm-server-key-disclosure.yamlscanner-rule-source · last read 2026-10-03 · latest outcome unchanged · supports Listed as a source for this family in the legacy taxonomy
Open questions
No open question is recorded for this revision.
Benchmark dossier notes
From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
- Shape
- literal
AAAAplus 7 characters (an 11-character head that base64url-decodes to the 64-bit Firebase project number), a literal:, then a 140-character body from[A-Za-z0-9_-]. Every real key measured hasAPA91bright after the colon; the contract does not require it. Late-2016 keys have 162 to 183-character bodies (8 of 66 unique real keys measured); about 88% of keys from 2017 onward have 140. - Basis
- T2, not T1. Google's only length statement (Firebase blog, 2017-01-31) is "a giant 175-character string", which the 140 contract does not match, and its only published
Authorization: key=example is the olderAIzaform. Corroboration: a real key in the Firebase JS SDK's own integration test (measured 11 +:+ 140), nuclei-templates, Burp BCheck, titus (ported from Nosey Parker rules; Nosey Parker itself has no Firebase rule), a Laravel scrubber and PyRIT. All tool regexes copy one 2020 write-up. - Issuance
- impossible: the legacy API is closed.
- Contract in core
- detector-families.md; evidence #649 record. Core's detector comments call the prefix and lengths "documented"; no provider does.
In this benchmark
Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
- Fixtures
- 45
- Left readable
- 0
- Redacted too much
- 0
- False alarms
- 0
45 fixtures: 18 expect a redaction, 27 must stay quiet. See every row
| Evidence level | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| T1Provider-documented | 1 | 0 | 0 | 0 |
| T2Tool-corroborated | 31 | 0 | 0 | 0 |
| T3Project policy | 13 | 0 | 0 | 0 |
Every scanner on the same fixtures
In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.
| Scanner | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it | 45 | 18 | 0 | 0 |
| gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it | 45 | 18 | 0 | 1 |
| redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped | 45 | 0 | 0 | 0 |
| trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it | 45 | 18 | 0 | 0 |
Benchmark dossier questions
Things the sources do not settle. They are listed so nobody reads them as settled.
- Open caveat
- No Google page states the shape; tool regexes trace to one 2020 write-up. The legacy FCM API was shut down in 2024, so a fresh key cannot be issued to check.
Looks like it, but isn't
Values the dossier records as resembling this credential without being one.
- Collisions
- FCM registration tokens (the 2017 Firebase blog calls a 153-character one a string that looks a lot like a server key) look similar and use the same
APA91bbody start; theAIzaGoogle API key form belongs togoogle:generic-api-key.
Scanner rules for this family
Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
No peer rule maps to this family
None of the reviewed peer scanners has a rule that can match a credential of this family.
None mapped
Fixtures in this family
45 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
| Fixture | Kind and evidence | redact-secret |
|---|---|---|
firebase-server-key-actions-envfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-compose-envfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-curl-sendfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-envfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-fcm-nodefirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-functions-config-getfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-handoff-notefirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-java-constantfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-k8s-secretfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-laravel-fcm-configfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-push-yamlfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-raw-requestfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-request-logfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-server-key-barefirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-server-key-quotedfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-server-key-unicode-crlffirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-settings-jsonfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-shell-exportfirebase · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
firebase-server-key-vapid-public-key-encoded-valuefirebase · benign-encoded-value | Must not flagT1 · Provider-documented | Quiet |
firebase-server-key-actions-secret-referencefirebase · templated-reference | Must not flagT3 · Project policy | Quiet |
firebase-server-key-config-lookup-referencefirebase · templated-reference | Must not flagT3 · Project policy | Quiet |
firebase-server-key-docs-ellipsis-placeholderfirebase · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
firebase-server-key-dotted-body-cli-twinfirebase · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
firebase-server-key-dotted-body-twinfirebase · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
firebase-server-key-head-only-near-missfirebase · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
firebase-server-key-impossible-head-near-missfirebase · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
firebase-server-key-long-head-twinfirebase · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
firebase-server-key-maskfirebase · benign-lookalike | Must not flagT3 · Project policy | Quiet |
firebase-server-key-masked-placeholderfirebase · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
firebase-server-key-message-id-public-idfirebase · public-identifier | Must not flagT3 · Project policy | Quiet |
firebase-server-key-migration-note-prosefirebase · prose-mention | Must not flagT3 · Project policy | Quiet |
firebase-server-key-missing-separatorfirebase · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
firebase-server-key-prefix-onlyfirebase · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
firebase-server-key-project-number-public-idfirebase · public-identifier | Must not flagT3 · Project policy | Quiet |
firebase-server-key-referencefirebase · benign-lookalike | Must not flagT3 · Project policy | Quiet |
firebase-server-key-registration-log-public-idfirebase · public-identifier | Must not flagT3 · Project policy | Quiet |
firebase-server-key-registration-token-public-idfirebase · public-identifier | Must not flagT3 · Project policy | Quiet |
firebase-server-key-sender-id-public-idfirebase · public-identifier | Must not flagT3 · Project policy | Quiet |
firebase-server-key-server-key-bare-twinfirebase · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
firebase-server-key-server-key-quoted-twinfirebase · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
firebase-server-key-server-key-unicode-crlf-twinfirebase · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
firebase-server-key-short-bodyfirebase · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
firebase-server-key-short-body-json-twinfirebase · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
firebase-server-key-short-body-twinfirebase · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
firebase-server-key-your-server-key-placeholderfirebase · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
Sources
Researched 2026-09-24.
Documentation and code
- github.com/projectdiscovery/nuclei-templates/blob/8cf94b93a389a47bef77b89f8c8915b2755018f0/http/exposures/tokens/firebase-fcm-server-key-disclosure.yaml
- firebase.googleblog.com/2017/01/debugging-firebase-cloud-messaging-on.html
- firebase.google.com/support/releases
- github.com/firebase/firebase-js-sdk/blob/5ab2fc6f889be5226f44d2e50c7eb20144f69338/integration/messaging/test/utils/sendMessage.js
Research log
- redact-secret/redact-secret#649Research issue
- Final evidence, pinned to a commit/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/649/README.md