Skip to content
Benchmarks

redact-secret · Report

API key (nvapi-)

nvapi- + at least 60 [A-Za-z0-9_-], open-ended (provider-authored floor, R2); the 128-byte cap is product policy. NGC Personal, NGC Service and build.nvidia.com keys share the prefix.

  • NVIDIA
  • Detectors: nvidia-api-key
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT1 · Provider-documented
  • Dossier researched2026-09-28
Beta.12 arrival family nvidia-api-key (#464, product redact-secret#972), contract in benchmarks/lib/beta8/464c.ts from the #860 handoff nvidia.md. T1 on the prefix, alphabet and floor; the cap is policy. trufflehog 3.97.4 NVAPI (exact 64) is mapped to this family and lags on every other width; gitleaks 8.30.1 has no rule. Since the 4fb7882 re-pin the product detector is in the pinned registry, so the row maps to it.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-28

3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-28 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^nvapi-[A-Za-z0-9_-]{60,}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
prefix nvapi-, then at least 60 characters of [A-Za-z0-9_-], open-ended; no separator or checksum. The 128-byte upper bound is product policy, not a provider fact.
Basis
prefix T1 (NVIDIA docs, and the ngcsdk constant SCOPED_KEY_PREFIX with an executing startswith, R1 and R6); alphabet and the floor of 60 T1 under R2 (a provider-authored secret-scanning rule in an NVIDIA-owned organization, added 2026-05-21; a second NVIDIA rule uses a floor of 40 with the same class). No provider source states an exact width.
Issuance
not attempted; a uniform width across the three key kinds would allow an exact-width contract later, as a separate optional change.
Contract in core
detector-families.md (no row until the Beta.12 detector, redact-secret#972, is merged).

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
39
Left readable
0
Redacted too much
0
False alarms
0

39 fixtures: 17 expect a redaction, 22 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T1Provider-documented17000
T2Tool-corroborated13000
T3Project policy9000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it391520
gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it39700
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped39000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabled1 rule targets it39400

Benchmark dossier questions

Things the sources do not settle. They are listed so nobody reads them as settled.
Open caveat
the 128-byte cap is project policy (the Apify precedent), so an over-long run is an intentional false negative, never truncated; bodies with a byte outside the class, and any key class shorter than 60, are accepted false negatives.

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
the peers disagree with the provider grammar: trufflehog's NVAPI is an exact 64, and betterleaks is {60,70} (tool-only, unpinned). NVAPI SDK and crate names (nvapi-sys, nvapi-rs) fall below the floor.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
Peer scanner rules that target this family
ScannerRuleWhat the rule matches
trufflehog · rules 3.97.4nvapinvapi- + 64 characters

No rule maps to this family in flare-redact, gitleaks, openredaction.

39 of 39 rows

Fixtures in this family

39 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in API key (nvapi-)
FixtureKind and evidenceredact-secret
nvidia-api-key-bare-prosenvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-bearer-headernvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-chat-nvidianvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-chat-pastenvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-curl-bearernvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-docker-login-stdinnvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-dotenvnvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-dotenv-ngcnvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-exportnvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-json-api-keynvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-json-tokennvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-key-shape-barenvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-key-shape-quotednvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-key-shape-unicode-crlfnvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-openai-compatnvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-sdk-kwargnvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-x-api-key-headernvidia · documented-format-literalMust redactT1 · Provider-documentedRedacted
nvidia-api-key-actions-secret-referencenvidia · templated-referenceMust not flagT3 · Project policyQuiet
nvidia-api-key-body-59-near-missnvidia · format-near-missMust not flagT2 · Tool-corroboratedQuiet
nvidia-api-key-body-59-twinnvidia · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
nvidia-api-key-dot-in-body-twinnvidia · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
nvidia-api-key-ellipsis-placeholdernvidia · documentation-placeholderMust not flagT3 · Project policyQuiet
nvidia-api-key-env-reference-referencenvidia · templated-referenceMust not flagT3 · Project policyQuiet
nvidia-api-key-key-guidance-prosenvidia · prose-mentionMust not flagT3 · Project policyQuiet
nvidia-api-key-label-prosenvidia · benign-lookalikeMust not flagT3 · Project policyQuiet
nvidia-api-key-leading-glue-twinnvidia · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
nvidia-api-key-leading-underscore-twinnvidia · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
nvidia-api-key-masknvidia · benign-lookalikeMust not flagT3 · Project policyQuiet
nvidia-api-key-other-prefix-64-near-missnvidia · format-near-missMust not flagT2 · Tool-corroboratedQuiet
nvidia-api-key-prefix-at-eol-near-missnvidia · format-near-missMust not flagT2 · Tool-corroboratedQuiet
nvidia-api-key-prefix-onlynvidia · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
nvidia-api-key-referencenvidia · benign-lookalikeMust not flagT3 · Project policyQuiet
nvidia-api-key-sdk-crate-names-public-idnvidia · public-identifierMust not flagT2 · Tool-corroboratedQuiet
nvidia-api-key-sdk-package-name-public-idnvidia · public-identifierMust not flagT2 · Tool-corroboratedQuiet
nvidia-api-key-short-bodynvidia · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
nvidia-api-key-underscore-prefix-twinnvidia · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
nvidia-api-key-uppercase-prefix-twinnvidia · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
nvidia-api-key-x-run-placeholdernvidia · documentation-placeholderMust not flagT3 · Project policyQuiet
nvidia-api-key-your-key-placeholdernvidia · documentation-placeholderMust not flagT3 · Project policyQuiet

Sources

Researched 2026-09-28.

Documentation and code

  • github.com/NVIDIA-NeMo/nemo-helix/blob/689f7852611b0151cee2748ca2b68e8e163e3b65/plugins/nemo-agents/src/nemo_agents_plugin/skills/agents-secure/resources/pii_scan.py#L229-L232
  • github.com/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/860/nvidia.md
  • github.com/redact-secret/redact-secret/blob/8b6a5fde52ecb4dfce13f09c7a947062d21483c7/docs/audits/evidence/860/issuance-research/nvidia.md

Research log