Skip to content
Benchmarks

redact-secret · Report

Read-write key (sk-helicone-)

sk-helicone- with optional -eu and -rl, then four 7-byte [a-z0-9] groups; or sk-helicone-proxy- + the groups + a lowercase UUID.

  • Helicone
  • Detectors: helicone-api-key
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT1 · Provider-documented
  • Dossier researched2026-09-28
Registry detector helicone-api-key since redact-secret#907 (registry pinned at 1127bf9); graduated from a Beta.11 arrival family (#434 slice e, #860 Tier A handoff), contract in benchmarks/lib/beta8/434e.ts. T1.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-28

3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-28 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^sk-helicone-(?:(?:eu-)?(?:rl-)?[a-z0-9]{7}(?:-[a-z0-9]{7}){3}|proxy-[a-z0-9]{7}(?:-[a-z0-9]{7}){3}-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
the shared grammar with role sk, plus a proxy key form sk-helicone-proxy- + the four groups + - + a lowercase 8-4-4-4-12 UUID (86 in total), T1 under R1 from the server generator.
Basis
T1 (worker validator regexes and generators; the -rl segment was added 2025-04-29). The role is documented.
Issuance
not attempted; the checklist also asks whether -gov combinations are accepted.
Contract in core
detector-families.md.

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
45
Left readable
0
Redacted too much
0
False alarms
0

45 fixtures: 16 expect a redaction, 29 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T1Provider-documented16000
T2Tool-corroborated21000
T3Project policy8000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it45131
gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it451601
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped45000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it451600

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
the legacy bare sk- + 4 groups of 7 (34 bytes, no helicone) is unattributable and overlaps the generic sk- space. Portal keys (sk-cp-) carry no provider token.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

No peer rule maps to this family

None of the reviewed peer scanners has a rule that can match a credential of this family.

None mapped

45 of 45 rows

Fixtures in this family

45 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in Read-write key (sk-helicone-)
FixtureKind and evidenceredact-secret
helicone-api-key-actions-envhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-bare-prosehelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-bearer-headerhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-chat-pastehelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-compose-envhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-digest-encoded-valuehelicone · benign-encoded-valueMust not flagT2 · Tool-corroboratedQuiet
helicone-api-key-dotenvhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-exporthelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-helicone-authhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-json-api-keyhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-json-tokenhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-key-shape-barehelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-key-shape-quotedhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-key-shape-unicode-crlfhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-openai-default-headershelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-sdk-kwarghelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-word-groups-near-misshelicone · format-near-missMust not flagT2 · Tool-corroboratedQuiet
helicone-api-key-x-api-key-headerhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-api-key-angle-placeholderhelicone · documentation-placeholderMust not flagT3 · Project policyQuiet
helicone-api-key-customer-portal-twinhelicone · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-dot-in-group-twinhelicone · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-ellipsis-placeholderhelicone · documentation-placeholderMust not flagT3 · Project policyQuiet
helicone-api-key-env-reference-referencehelicone · templated-referenceMust not flagT3 · Project policyQuiet
helicone-api-key-five-groups-twinhelicone · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-group-of-6-twinhelicone · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-group-of-8-twinhelicone · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-label-prosehelicone · benign-lookalikeMust not flagT3 · Project policyQuiet
helicone-api-key-leading-glue-twinhelicone · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-legacy-bare-twinhelicone · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-maskhelicone · benign-lookalikeMust not flagT3 · Project policyQuiet
helicone-api-key-prefix-onlyhelicone · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
helicone-api-key-provider-segment-glued-twinhelicone · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-proxy-malformed-uuid-twinhelicone · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-python-environ-referencehelicone · templated-referenceMust not flagT3 · Project policyQuiet
helicone-api-key-referencehelicone · benign-lookalikeMust not flagT3 · Project policyQuiet
helicone-api-key-request-id-public-idhelicone · public-identifierMust not flagT2 · Tool-corroboratedQuiet
helicone-api-key-role-guidance-prosehelicone · prose-mentionMust not flagT3 · Project policyQuiet
helicone-api-key-segment-order-twinhelicone · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-short-bodyhelicone · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
helicone-api-key-three-groups-twinhelicone · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-trailing-glue-twinhelicone · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-truncated-near-misshelicone · format-near-missMust not flagT2 · Tool-corroboratedQuiet
helicone-api-key-underscore-separators-twinhelicone · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-uppercase-byte-twinhelicone · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
helicone-api-key-urls-public-idhelicone · public-identifierMust not flagT2 · Tool-corroboratedQuiet

Sources

Researched 2026-09-28.

Documentation and code

  • docs.helicone.ai/helicone-headers/helicone-auth
  • github.com/redact-secret/redact-secret/blob/270faf84dc12f6a4a4cf61fe3ffab7aadc4f7262/docs/audits/evidence/860/helicone.md
  • github.com/Helicone/helicone/tree/067d9290acb4f1fc9320e902fc67b4b399b50363

Research log

Other Helicone families