redact-secret · Report
User token (squ_)
squ_ + exactly 40 lowercase hex (44 in all); unprefixed legacy tokens, sqb_ badge tokens and SonarQube Cloud sqco_ are not claimed.
Beta.12 arrival family sonarqube-token (#528, product redact-secret#1021), contract in benchmarks/lib/beta8/528c.ts from the #1014 handoff sonarqube.md. T1 (provider generator, R1). gitleaks 8.30.1 sonar-api-token (keyword-gated) is mapped to this family; trufflehog 3.97.4 SonarCloud reads legacy and sqco_ shapes only. Since the 4fb7882 re-pin the product detector is in the pinned registry, so the row maps to it.
Research record
From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-29 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.
Format
Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.
What it looks like
- Descriptive pattern
^squ_[0-9a-f]{40}$
Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.
Format facts
Provider documented ·
provider-source· current · observed 2026-09-29SonarSource/sonarqube TokenGeneratorImpl.java (9ec5e86, last changed 2026-04-17) and TokenType.java: "sq" + type letter + "_" + Hex.encodeHexString(20 SecureRandom bytes); re-checked 2026-09-29: squ_ + exactly 40 lowercase hex, 44 in all; no checksum
- SonarSource/sonarqube @ 9ec5e86425011f6c1ffa0eb2db08880e3b347271: server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/TokenGeneratorImpl.javaprovider-documentation · last read 2026-09-29 · latest outcome read · supports squ_ + exactly 40 lowercase hex, 44 in all; no checksum · #L29-L46
Unresolved ·
tool-corroboration· current · observed 2026-09-29Pinned scanner rules are consistent with the contract grammar (1 artifact: gitleaks 8.30.1).
- gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports gitleaks 8.30.1: sonar-api-token (keyword-gated; (?:squ_|sqp_|sqa_)?[a-z0-9=_-]{40})
Provider documented ·
field-prefix· current · observed 2026-09-29prefix: squ_ (the user token type letter u)
- SonarSource/sonarqube @ 9ec5e86425011f6c1ffa0eb2db08880e3b347271: server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/TokenGeneratorImpl.javaprovider-documentation · last read 2026-09-29 · latest outcome read · supports SONARQUBE_TOKEN_PREFIX = "sq" + tokenType.getIdentifier() + "_" · #L29-L46
- SonarSource/sonarqube @ 9ec5e86425011f6c1ffa0eb2db08880e3b347271: server/sonar-db-dao/src/main/java/org/sonar/db/user/TokenType.javaprovider-sdk-source · last read 2026-09-29 · latest outcome read · supports u user, a global analysis, b project badge, p project analysis · #L24-L27
Provider documented ·
field-body· current · observed 2026-09-29body: exactly 40 lowercase hex [0-9a-f] (20 SecureRandom bytes, Hex.encodeHexString); 44 in all
- SonarSource/sonarqube @ 9ec5e86425011f6c1ffa0eb2db08880e3b347271: server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/TokenGeneratorImpl.javaprovider-documentation · last read 2026-09-29 · latest outcome read · supports body: exactly 40 lowercase hex [0-9a-f] (20 SecureRandom bytes, Hex.encodeHexString); 44 in all · #L29-L46
Unresolved ·
field-boundary· current · observed 2026-09-29boundary: a token glued to an identifier on either side ([A-Za-z0-9_-]) is not claimed (Handoff boundary decision, not a provider statement.)
- redact-secret/redact-secret @ 4f220ea000b58fa2e0e431ad88dea4eccb393fb0: docs/audits/evidence/1014/sonarqube.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports implementation notes
Provider documented ·
field-transport· current · observed 2026-09-29transport: SONAR_TOKEN; sonar-scanner -Dsonar.token= (and the legacy -Dsonar.login=); sonar.token in sonar-project.properties; Gradle systemProp.sonar.token
- redact-secret/redact-secret @ 4f220ea000b58fa2e0e431ad88dea4eccb393fb0: docs/audits/evidence/1014/sonarqube.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports test axes
Provider documented ·
field-excluded-siblings· current · observed 2026-09-29excluded-siblings: sqb_ + 40 hex project badge tokens are read-only and published in README badge URLs (Q5); unprefixed 40-hex legacy tokens (before 9.5) are SHA-1 shaped; SonarQube Cloud sqco_ is another product (sqb_ in a badge URL and a bare 40-hex git SHA are benign controls; legacy tokens and sqco_ are authored neither way.)
- redact-secret/redact-secret @ 4f220ea000b58fa2e0e431ad88dea4eccb393fb0: docs/audits/evidence/1014/README.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports Q5 · #ruling-questions-for-the-maintainer
- redact-secret/redact-secret @ 4f220ea000b58fa2e0e431ad88dea4eccb393fb0: docs/audits/evidence/1014/sonarqube.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports excluded shapes
- SonarSource/sonarqube @ 9ec5e86425011f6c1ffa0eb2db08880e3b347271: server/sonar-db-dao/src/main/java/org/sonar/db/user/TokenType.javaprovider-sdk-source · last read 2026-09-29 · latest outcome read · supports b project badge · #L24-L27
Tool corroborated ·
field-peer-lag· current · observed 2026-09-29peer-lag: gitleaks 8.30.1 sonar-api-token is keyword-gated on sonar.login/sonar.token-style names with an optional squ_|sqp_|sqa_ prefix before [a-z0-9=_-]{40}: it lags on bare prose, chat and JSON "token" and reads every prefix under one label (mapped to sonarqube-token, so an analysis-token finding reads as co-detection). trufflehog 3.97.4 SonarCloud v1 wants a word-bounded bare [0-9a-z]{40} near "sonar" (legacy tokens only; it cannot match inside squ_ + 40) and v2 reads sqco_ + 59, so it lags on every positive and stays unmapped
- gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports sonar-api-token
- trufflesecurity/trufflehog @ v3.97.4: pkg/detectorsscanner-rule-source · last read 2026-09-29 · latest outcome read · supports sonarcloud/v2: sqco_
- trufflesecurity/trufflehog @ v3.97.4: pkg/detectors/sonarcloud/v1/sonarcloud.goscanner-rule-source · last read 2026-09-29 · latest outcome read · supports SonarCloud v1
Unresolved ·
listed-references· current · observed 2026-09-29The legacy contract lists 10 references without stating which property each supports.
- redact-secret/redact-secret @ 4f220ea000b58fa2e0e431ad88dea4eccb393fb0: docs/audits/evidence/1014/README.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #ruling-questions-for-the-maintainer
- redact-secret/redact-secret @ 4f220ea000b58fa2e0e431ad88dea4eccb393fb0: docs/audits/evidence/1014/README.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret/issues/1014issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #issuecomment-5900447016
- github.com/redact-secret/redact-secret/issues/1014issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret/issues/860issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #issuecomment-5852413851
- github.com/redact-secret/redact-secret/issues/1021issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- redact-secret/redact-secret @ 4f220ea000b58fa2e0e431ad88dea4eccb393fb0: docs/audits/evidence/1014/sonarqube.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret-benchmarks/issues/528issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- SonarSource/sonarqube @ 9ec5e86425011f6c1ffa0eb2db08880e3b347271: server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/TokenGeneratorImpl.javaprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #L29-L46
- SonarSource/sonarqube @ 9ec5e86425011f6c1ffa0eb2db08880e3b347271: server/sonar-db-dao/src/main/java/org/sonar/db/user/TokenType.javaprovider-sdk-source · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #L24-L27
Provider documented ·
dossier-research· current · observed 2026-09-29Legacy dossier research (verdict ready, tier T1) cited 2 sources; the dossier does not attribute sources to individual properties.
- redact-secret/redact-secret @ 378581770a87751d72e27529796c4f790649fd00: docs/audits/evidence/1014/sonarqube.mdproject-research-note · last read 2026-09-29 · latest outcome read · supports Final research evidence recorded by the legacy dossier
- SonarSource/sonarqube @ 9ec5e86425011f6c1ffa0eb2db08880e3b347271: server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/TokenGeneratorImpl.javaprovider-documentation · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family · #L29-L46
Provider documented ·
taxonomy-sources· current · observed 2026-09-29The legacy taxonomy lists 2 sources for this family. The taxonomy records no date; the dossier researchedAt is used as the observed-at date.
- redact-secret/redact-secret @ 4f220ea000b58fa2e0e431ad88dea4eccb393fb0: docs/audits/evidence/1014/sonarqube.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy
- SonarSource/sonarqube @ 9ec5e86425011f6c1ffa0eb2db08880e3b347271: server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/TokenGeneratorImpl.javaprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy · #L29-L46
Open questions
No open question is recorded for this revision.
Benchmark dossier notes
From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
- Shape
squ_+ exactly 40 lowercase hex (44 in all).- Basis
- T1 under R1 from the provider token generator and token-type enum.
- Issuance
- not attempted; the grammar is T1 from provider sources, so no key is needed.
- Contract in core
- detector-families.md (row on
main; the Beta.12 detector, redact-secret#1021, merged in redact-secret#1039 and is unreleased).
In this benchmark
Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
- Fixtures
- 40
- Left readable
- 0
- Redacted too much
- 0
- False alarms
- 0
40 fixtures: 17 expect a redaction, 23 must stay quiet. See every row
| Evidence level | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| T1Provider-documented | 17 | 0 | 0 | 0 |
| T2Tool-corroborated | 15 | 0 | 0 | 0 |
| T3Project policy | 8 | 0 | 0 | 0 |
Every scanner on the same fixtures
In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.
| Scanner | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it | 40 | 16 | 1 | 0 |
| gitleaksRepository scanner · 8.30.1 · Directory scan · default rules1 rule targets it | 40 | 6 | 0 | 1 |
| redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped | 40 | 0 | 0 | 0 |
| trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it | 40 | 17 | 0 | 0 |
Looks like it, but isn't
Values the dossier records as resembling this credential without being one.
- Collisions
- the 40-hex body alone is SHA-1 shaped, so the prefix is load-bearing;
sqb_badge tokens are public (Q5).
Scanner rules for this family
Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
| Scanner | Rule | What the rule matches |
|---|---|---|
| gitleaks · rules 8.30.1 | sonar-api-token | sonar login or token keyword + squ_, sqp_ or sqa_ + 40 characters |
No rule maps to this family in flare-redact, openredaction, trufflehog.
Fixtures in this family
40 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
| Fixture | Kind and evidence | redact-secret |
|---|---|---|
sonarqube-token-actions-envsonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-bare-prosesonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-bearer-headersonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-chat-pastesonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-dotenvsonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-exportsonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-gradle-system-propsonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-json-api-keysonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-json-tokensonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-key-shape-baresonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-key-shape-quotedsonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-key-shape-unicode-crlfsonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-project-propertiessonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-scanner-login-flagsonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-scanner-token-flagsonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-sdk-kwargsonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-x-api-key-headersonarqube · documented-format-literal | Must redactT1 · Provider-documented | Redacted |
sonarqube-token-x-run-placeholdersonarqube · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
sonarqube-token-actions-secret-referencesonarqube · templated-reference | Must not flagT3 · Project policy | Quiet |
sonarqube-token-badge-token-url-public-idsonarqube · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
sonarqube-token-body-39-twinsonarqube · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
sonarqube-token-body-41-twinsonarqube · wrong-length | Must not flagT2 · Tool-corroborated · twin | Quiet |
sonarqube-token-ellipsis-placeholdersonarqube · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
sonarqube-token-env-reference-referencesonarqube · templated-reference | Must not flagT3 · Project policy | Quiet |
sonarqube-token-git-sha-encoded-valuesonarqube · benign-encoded-value | Must not flagT2 · Tool-corroborated | Quiet |
sonarqube-token-label-prosesonarqube · benign-lookalike | Must not flagT3 · Project policy | Quiet |
sonarqube-token-leading-glue-twinsonarqube · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
sonarqube-token-leading-underscore-twinsonarqube · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
sonarqube-token-masksonarqube · benign-lookalike | Must not flagT3 · Project policy | Quiet |
sonarqube-token-non-hex-letter-twinsonarqube · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
sonarqube-token-prefix-onlysonarqube · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
sonarqube-token-referencesonarqube · benign-lookalike | Must not flagT3 · Project policy | Quiet |
sonarqube-token-sha1-checksum-encoded-valuesonarqube · benign-encoded-value | Must not flagT2 · Tool-corroborated | Quiet |
sonarqube-token-short-bodysonarqube · benign-lookalike | Must not flagT2 · Tool-corroborated | Quiet |
sonarqube-token-token-guidance-prosesonarqube · prose-mention | Must not flagT3 · Project policy | Quiet |
sonarqube-token-trailing-underscore-twinsonarqube · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
sonarqube-token-truncated-near-misssonarqube · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
sonarqube-token-unknown-type-letter-twinsonarqube · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
sonarqube-token-uppercase-hex-byte-twinsonarqube · wrong-alphabet | Must not flagT2 · Tool-corroborated · twin | Quiet |
sonarqube-token-uppercase-prefix-twinsonarqube · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
Sources
Researched 2026-09-29.
Documentation and code
- github.com/SonarSource/sonarqube/blob/9ec5e86425011f6c1ffa0eb2db08880e3b347271/server/sonar-webserver-auth/src/main/java/org/sonar/server/usertoken/TokenGeneratorImpl.java#L29-L46
- github.com/redact-secret/redact-secret/blob/4f220ea000b58fa2e0e431ad88dea4eccb393fb0/docs/audits/evidence/1014/sonarqube.md
Research log
- redact-secret/redact-secret#1014Research issue
- redact-secret/redact-secret#1021Research issue
- redact-secret/redact-secret#1039Research issue
- redact-secret/redact-secret-benchmarks#528Research issue
- Final evidence, pinned to a commit/redact-secret/redact-secret/blob/378581770a87751d72e27529796c4f790649fd00/docs/audits/evidence/1014/sonarqube.md