Skip to content
Benchmarks

redact-secret · Report

Runner authentication token

glrt--prefixed runner authentication token: a 20-character legacy body, or the routable base64url payload with a base36 length holder and CRC32 checksum.

  • GitLab
  • Detectors: gitlab-runner-authentication-token
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT2 · Tool-corroborated
  • Dossier researched2026-09-25
Registry detector gitlab-runner-authentication-token since redact-secret#730 (registry pinned at f2082ab); graduated from a Beta.8 arrival family (#212, research #230), contract in benchmarks/lib/beta8/212.ts. glrtr-, instance-prefixed and unversioned routable variants are not claimed. gitlab-token contract covers glpat- only.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-25

3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-25 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^glrt-(?:(?:t[0-9a-f]+_)?[A-Za-z0-9_-]{20}|[A-Za-z0-9_-]{27,300}\.[0-9a-z]{2}\.[0-9a-z]{9})$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
prefix glrt- followed by one of three bodies. (a) Legacy: 20 characters of a URL-safe alphabet from GitLab's friendly_token ([A-Za-z0-9_-] minus l, I, O, 0). (b) Partition-prefixed: t<hex>_ then the 20 characters, seen in a March 2025 forum post. (c) Routable, from GitLab 18.0: a base64url payload (27 to 300 characters), ., a 2-character base36 version, ., a 2-character base36 payload length and a 7-character base36 CRC32 of everything before it.
Basis
T1 for the prefix (token overview and new-runner-workflow pages). Body and checksum come from GitLab's own server code (routable_token.rb, Devise's friendly_token) and its secret-detection rules, so they are provider code but not documentation; gitleaks agrees on the legacy body. The design document is proposed and omits the version segment the code emits. The tier is T2.
Issuance
POST /user/runners or the runner creation UI. Not attempted. Registration tokens (GR1348941 plus 20 characters) are a separate, deprecated class.
Contract in core
detector-families.md (Beta.8 wave 2, empirical route): exact 20-byte body or the routable form with the length holder and CRC32 checked offline; glrtr-, instance-prefixed and unversioned forms are unclaimed.

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
43
Left readable
0
Redacted too much
0
False alarms
0

43 fixtures: 19 expect a redaction, 24 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T2Tool-corroborated34000
T3Project policy9000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it431900
gitleaksRepository scanner · 8.30.1 · Directory scan · default rules2 rules target it43303
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped43000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it431901

Benchmark dossier questions

Things the sources do not settle. They are listed so nobody reads them as settled.
Open caveat
Prefix is documented; the 20-character body and routable grammar come from GitLab server code and gitleaks. glrtr-, instance-prefixed and unversioned routable forms are unverified. No issued token captured.

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
other gl prefixes (glpat-, gldt-, glcbt-) are real GitLab secrets, not clean negatives. glrtr- is a superstring of glrt and is not matched by a glrt- rule. Runner ids and s_ + 12 hex system ids are public. Instance-prefixed tokens (<prefix>-glrt-) exist behind a feature flag and are documented as not production ready.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
Peer scanner rules that target this family
ScannerRuleWhat the rule matches
gitleaks · rules 8.30.1gitlab-runner-authentication-tokenglrt- + 20 characters
gitleaks · rules 8.30.1gitlab-runner-authentication-token-routableglrt-t<digit>_ + routable payload

No rule maps to this family in flare-redact, openredaction, trufflehog.

43 of 43 rows

Fixtures in this family

43 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in Runner authentication token
FixtureKind and evidenceredact-secret
gitlab-runner-authentication-token-api-headergitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-checksum-mismatch-twingitlab · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
gitlab-runner-authentication-token-ci-server-tokengitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-config-tomlgitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-docker-registergitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-exportgitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-handovergitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-helm-valuesgitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-k8s-secretgitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-length-holder-mismatch-twingitlab · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
gitlab-runner-authentication-token-prefix-letter-twingitlab · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
gitlab-runner-authentication-token-query-tokengitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-register-flaggitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-register-outputgitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-runner-loggitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-terraform-runnergitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-token-shape-baregitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-token-shape-quotedgitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-token-shape-unicode-crlfgitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-twin-base-registergitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-twin-base-tomlgitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-uppercase-base36-twingitlab · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
gitlab-runner-authentication-token-user-runners-responsegitlab · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
gitlab-runner-authentication-token-angle-placeholder-placeholdergitlab · documentation-placeholderMust not flagT3 · Project policyQuiet
gitlab-runner-authentication-token-base64-url-encoded-valuegitlab · benign-encoded-valueMust not flagT2 · Tool-corroboratedQuiet
gitlab-runner-authentication-token-helm-template-referencegitlab · templated-referenceMust not flagT3 · Project policyQuiet
gitlab-runner-authentication-token-label-prosegitlab · benign-lookalikeMust not flagT3 · Project policyQuiet
gitlab-runner-authentication-token-maskgitlab · benign-lookalikeMust not flagT3 · Project policyQuiet
gitlab-runner-authentication-token-masked-placeholdergitlab · documentation-placeholderMust not flagT3 · Project policyQuiet
gitlab-runner-authentication-token-migration-note-prosegitlab · prose-mentionMust not flagT3 · Project policyQuiet
gitlab-runner-authentication-token-prefix-onlygitlab · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
gitlab-runner-authentication-token-prefix-only-near-missgitlab · format-near-missMust not flagT2 · Tool-corroboratedQuiet
gitlab-runner-authentication-token-redacted-placeholdergitlab · documentation-placeholderMust not flagT3 · Project policyQuiet
gitlab-runner-authentication-token-referencegitlab · benign-lookalikeMust not flagT3 · Project policyQuiet
gitlab-runner-authentication-token-runner-object-public-idgitlab · public-identifierMust not flagT2 · Tool-corroboratedQuiet
gitlab-runner-authentication-token-shell-reference-referencegitlab · templated-referenceMust not flagT3 · Project policyQuiet
gitlab-runner-authentication-token-short-bodygitlab · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
gitlab-runner-authentication-token-short-body-twingitlab · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
gitlab-runner-authentication-token-short-body-twin-wrong-lengthgitlab · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
gitlab-runner-authentication-token-short-sha-public-idgitlab · public-identifierMust not flagT2 · Tool-corroboratedQuiet
gitlab-runner-authentication-token-stem-prefix-twingitlab · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
gitlab-runner-authentication-token-system-id-public-idgitlab · public-identifierMust not flagT2 · Tool-corroboratedQuiet
gitlab-runner-authentication-token-underscore-delimiter-twingitlab · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet

Sources

Researched 2026-09-25.

Documentation and code

Research log

Other GitLab families