Skip to content
Benchmarks

redact-secret · Report

Organization access token (polar_oat_)

polar_oat_ + exactly 43 [A-Za-z0-9] (37 random + a 6-character base62 CRC32); the checksum corroborates only and never rejects (policy).

  • Polar
  • Detectors: polar-token
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT1 · Provider-documented
  • Dossier researched2026-09-29
Beta.12 arrival family polar-token (#528, product redact-secret#1020), contract in benchmarks/lib/beta8/528b.ts from the #1014 handoff polar.md. T1 (provider server code, R1/R9). whsec_ webhook secrets stay with stripe-token; polar_ci_ is public. Neither pinned scanner has a Polar rule. Since the 4fb7882 re-pin the product detector is in the pinned registry, so the row maps to it.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-29

Format revisions

  • Revision 1 polar:organization-access-token@1current · draft, not reviewed · superseded by @2 · the family's current revision
  • Revision 2 polar:organization-access-token@2proposed · draft, not reviewed · supersedes @1

8 events in the review history: 2 authored, 5 observed, 1 reviewed. Latest: authored on 2026-10-05 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^polar_oat_[A-Za-z0-9]{43}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
polar_oat_ + exactly 43 [A-Za-z0-9]: 37 random, then the CRC32 of those 37 in base62, zero-padded to 6.
Basis
T1 under R1 and R9 from the provider server code; the service postdates the 2025-01-02 checksum era, so there is one era. The checksum corroborates only and never rejects (policy; ruling Q1 open).
Issuance
not attempted; the grammar is T1 from provider sources, so no key is needed.
Contract in core
detector-families.md (row on main; the Beta.12 detector, redact-secret#1020, merged in redact-secret#1039 and is unreleased).

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
38
Left readable
0
Redacted too much
0
False alarms
0

38 fixtures: 17 expect a redaction, 21 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T1Provider-documented25000
T3Project policy8000
T0Pending review5000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it381610
gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it38700
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped38000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it381700

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
whsec_ webhook secrets come from the same generator but stripe-token owns the prefix (misattributed, still redacted); polar_ci_ is a public client id (Q5).

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

No peer rule maps to this family

None of the reviewed peer scanners has a rule that can match a credential of this family.

None mapped

38 of 38 rows

Fixtures in this family

38 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in Organization access token (polar_oat_)
FixtureKind and evidenceredact-secret
polar-token-bare-prosepolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-bearer-headerpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-chat-pastepolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-checksum-mismatch-dotenvpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-checksum-mismatch-logpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-dotenvpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-exportpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-json-api-keypolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-json-tokenpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-key-shape-barepolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-key-shape-quotedpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-key-shape-unicode-crlfpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-mcp-envpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-python-sdkpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-sdk-kwargpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-ts-sdkpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-x-api-key-headerpolar · documented-format-literalMust redactT1 · Provider-documentedRedacted
polar-token-actions-secret-referencepolar · templated-referenceMust not flagT3 · Project policyQuiet
polar-token-body-42-twinpolar · wrong-lengthMust not flagT1 · Provider-documented · twinQuiet
polar-token-body-44-twinpolar · unsettled-evidence-inputPending reviewT0 · Pending · twinUnscored
polar-token-ellipsis-placeholderpolar · documentation-placeholderMust not flagT3 · Project policyQuiet
polar-token-env-reference-referencepolar · templated-referenceMust not flagT3 · Project policyQuiet
polar-token-hyphen-in-body-twinpolar · wrong-alphabetMust not flagT1 · Provider-documented · twinQuiet
polar-token-identifier-name-public-idpolar · public-identifierMust not flagT1 · Provider-documentedQuiet
polar-token-label-prosepolar · benign-lookalikeMust not flagT3 · Project policyQuiet
polar-token-leading-glue-twinpolar · unsettled-evidence-inputPending reviewT0 · Pending · twinUnscored
polar-token-maskpolar · benign-lookalikeMust not flagT3 · Project policyQuiet
polar-token-oauth-client-id-public-idpolar · unsettled-evidence-inputPending reviewT0 · PendingUnscored
polar-token-prefix-onlypolar · benign-lookalikeMust not flagT1 · Provider-documentedQuiet
polar-token-referencepolar · benign-lookalikeMust not flagT3 · Project policyQuiet
polar-token-short-bodypolar · benign-lookalikeMust not flagT1 · Provider-documentedQuiet
polar-token-token-guidance-prosepolar · prose-mentionMust not flagT3 · Project policyQuiet
polar-token-trailing-hyphen-twinpolar · unsettled-evidence-inputPending reviewT0 · Pending · twinUnscored
polar-token-trailing-underscore-twinpolar · unsettled-evidence-inputPending reviewT0 · Pending · twinUnscored
polar-token-truncated-near-misspolar · format-near-missMust not flagT1 · Provider-documentedQuiet
polar-token-underscore-in-body-twinpolar · wrong-alphabetMust not flagT1 · Provider-documented · twinQuiet
polar-token-uppercase-prefix-twinpolar · prefix-near-missMust not flagT1 · Provider-documented · twinQuiet
polar-token-x-run-placeholderpolar · documentation-placeholderMust not flagT3 · Project policyQuiet

Sources

Researched 2026-09-29.

Documentation and code

  • github.com/polarsource/polar/blob/6a4f2f6d6083ef503cd23cb7f432ab2c60515973/server/polar/kit/crypto.py#L11-L32
  • github.com/redact-secret/redact-secret/blob/4f220ea000b58fa2e0e431ad88dea4eccb393fb0/docs/audits/evidence/1014/polar.md
  • github.com/polarsource/polar/blob/6a4f2f6d6083ef503cd23cb7f432ab2c60515973/server/polar/organization_access_token/service.py#L42

Research log

Other Polar families