Skip to content
Benchmarks

redact-secret · Report

Write-only key (pk-helicone-)

pk-helicone- with optional -eu and -rl, then four 7-byte [a-z0-9] groups; a write credential, not a public identifier.

  • Helicone
  • Detectors: helicone-write-api-key
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT1 · Provider-documented
  • Dossier researched2026-09-28
Scored arrival family helicone-write-api-key: the product types it inside the shared helicone-api-key detector as helicone_write_api_key since redact-secret#907 (registry pinned at 1127bf9; scanners/families.mjs arrivalFindingTypes). Authored as a Beta.11 arrival family (#434 slice e, #860 Tier A handoff), contract in benchmarks/lib/beta8/434e.ts. T1.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-28

3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-28 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^pk-helicone-(?:eu-)?(?:rl-)?[a-z0-9]{7}(?:-[a-z0-9]{7}){3}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
the shared grammar with role pk.
Basis
T1, same validator and generators. The handoff treats pk- as a credential: Helicone documents it as an API key with write permission and no provider source calls it public (unlike PostHog phc_). The docs allow placing it in a URL path, a transport convenience that does not make it public.
Contract in core
detector-families.md.

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
36
Left readable
0
Redacted too much
0
False alarms
0

36 fixtures: 12 expect a redaction, 24 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T1Provider-documented12000
T2Tool-corroborated19000
T3Project policy5000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it36930
gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it361201
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped36000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it361200

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
none beyond the legacy bare and portal shapes above.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

No peer rule maps to this family

None of the reviewed peer scanners has a rule that can match a credential of this family.

None mapped

36 of 36 rows

Fixtures in this family

36 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in Write-only key (pk-helicone-)
FixtureKind and evidenceredact-secret
helicone-write-api-key-bare-prosehelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-bearer-headerhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-chat-pastehelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-digest-encoded-valuehelicone · benign-encoded-valueMust not flagT2 · Tool-corroboratedQuiet
helicone-write-api-key-dotenvhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-exporthelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-gateway-url-pathhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-helicone-authhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-json-api-keyhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-json-tokenhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-openai-default-headershelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-sdk-kwarghelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-x-api-key-headerhelicone · documented-format-literalMust redactT1 · Provider-documentedRedacted
helicone-write-api-key-angle-placeholderhelicone · documentation-placeholderMust not flagT3 · Project policyQuiet
helicone-write-api-key-customer-portal-twinhelicone · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-dot-in-group-twinhelicone · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-ellipsis-placeholderhelicone · documentation-placeholderMust not flagT3 · Project policyQuiet
helicone-write-api-key-env-reference-referencehelicone · templated-referenceMust not flagT3 · Project policyQuiet
helicone-write-api-key-five-groups-twinhelicone · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-group-of-6-twinhelicone · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-group-of-8-twinhelicone · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-leading-glue-twinhelicone · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-legacy-bare-twinhelicone · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-provider-segment-glued-twinhelicone · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-python-environ-referencehelicone · templated-referenceMust not flagT3 · Project policyQuiet
helicone-write-api-key-request-id-public-idhelicone · public-identifierMust not flagT2 · Tool-corroboratedQuiet
helicone-write-api-key-role-guidance-prosehelicone · prose-mentionMust not flagT3 · Project policyQuiet
helicone-write-api-key-segment-order-twinhelicone · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-three-groups-twinhelicone · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-trailing-glue-twinhelicone · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-truncated-near-misshelicone · format-near-missMust not flagT2 · Tool-corroboratedQuiet
helicone-write-api-key-underscore-separator-in-path-twinhelicone · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-underscore-separators-twinhelicone · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-uppercase-byte-twinhelicone · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
helicone-write-api-key-urls-public-idhelicone · public-identifierMust not flagT2 · Tool-corroboratedQuiet
helicone-write-api-key-word-groups-near-misshelicone · format-near-missMust not flagT2 · Tool-corroboratedQuiet

Sources

Researched 2026-09-28.

Documentation and code

  • docs.helicone.ai/helicone-headers/helicone-auth
  • github.com/redact-secret/redact-secret/blob/270faf84dc12f6a4a4cf61fe3ffab7aadc4f7262/docs/audits/evidence/860/helicone.md
  • github.com/Helicone/helicone/tree/067d9290acb4f1fc9320e902fc67b4b399b50363

Research log

Other Helicone families