Skip to content
Benchmarks

redact-secret · Report

API key (tvly-)

tvly- with an optional dev- segment and a 32-character alphanumeric body; tvly-prod- and production key widths are unresolved.

  • Tavily
  • Detectors: tavily-api-key
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT2 · Tool-corroborated
  • Dossier researched2026-09-27
Registry detector tavily-api-key since redact-secret#867 (registry pinned at cfe2aec); graduated from a Beta.10 arrival family (#384, research #786), contract in benchmarks/lib/beta8/384d.ts. T2; no pinned scanner has a Tavily rule (noseyparker and GitGuardian only).

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · current
  • ResearchResearched
  • Researched2026-09-27

3 events in the review history: 2 observed, 1 reviewed. Latest: observed on 2026-09-27 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Descriptive pattern
^tvly-(?:dev-)?[A-Za-z0-9]{32}$

Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
tvly-, an optional dev- segment, then 32 alphanumeric characters [A-Za-z0-9]. Pre-2025 samples have no dev-; 2025 samples and the docs' truncated examples do. Whether tvly-prod- exists and the width of production and enterprise key bodies are unresolved (a third-party page says production keys begin plain tvly-).
Basis
the spec and #867 record prefix T1, body T2 (the tier field above follows the assessment contract, T2, see Open questions). Provider docs show tvly- only in a placeholder (Bearer tvly-YOUR_API_KEY) and tvly-dev- in truncated samples, with no length or alphabet; the SDKs do no validation. The 32-character body rests on the noseyparker rule, which predates dev- and so misses it, and three observed samples. GitGuardian confirms "Prefixed" and states no length. No pinned scanner has a Tavily rule.
Issuance
not attempted. The #786 checklist covers one development key (prefix, body width, charset), a production key if available, and masked display.
Contract in core
detector-families.md, section Together AI and Tavily (#867). tvly-prod- and other widths stay unclaimed.

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
Fixtures
45
Left readable
0
Redacted too much
0
False alarms
0

45 fixtures: 18 expect a redaction, 27 must stay quiet. See every row

redact-secret fixture counts by evidence level
Evidence levelFixturesLeft readableToo muchFalse alarms
T2Tool-corroborated36000
T3Project policy9000

Every scanner on the same fixtures

In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.

Counts per scanner on this family's fixtures
ScannerFixturesLeft readableToo muchFalse alarms
flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it451621
gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it451104
redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped45000
trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it451800

Benchmark dossier questions

Things the sources do not settle. They are listed so nobody reads them as settled.
Open caveat
T1 is the tvly- prefix only; the 32-alphanumeric body is T2 (one scanner rule, three observed samples). Needs one issued development key; tvly-prod- and production width open (checklist in #786).

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
the tvly command-line tool, key names such as development-...-#1, request_id values and the doc placeholder are benign. Bearer tvly-YOUR_API_KEY was a bearer-token false alarm fixed by #870 (Beta.10 epic #774).

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

No peer rule maps to this family

None of the reviewed peer scanners has a rule that can match a credential of this family.

None mapped

45 of 45 rows

Fixtures in this family

45 rows, redact-secret's outcome on each. Rows that need a look come first (0), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
Fixtures in API key (tvly-)
FixtureKind and evidenceredact-secret
tavily-api-key-actions-envtavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-cli-flagtavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-compose-envtavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-curl-bearertavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-docs-bearer-placeholdertavily · documentation-placeholderMust not flagT3 · Project policyQuiet
tavily-api-key-dotenv-devtavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-export-baretavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-js-clienttavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-json-bodytavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-key-digest-encoded-valuetavily · benign-encoded-valueMust not flagT2 · Tool-corroboratedQuiet
tavily-api-key-key-shape-baretavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-key-shape-quotedtavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-key-shape-unicode-crlftavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-langchain-kwargtavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-mcp-client-envtavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-prefix-absent-twintavily · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
tavily-api-key-python-clienttavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-remote-mcp-querytavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-search-logtavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-tool-calltavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-uppercase-prefix-twintavily · prefix-near-missMust not flagT2 · Tool-corroborated · twinQuiet
tavily-api-key-yaml-configtavily · documented-format-literalMust redactT2 · Tool-corroboratedRedacted
tavily-api-key-base64-etag-encoded-valuetavily · benign-encoded-valueMust not flagT2 · Tool-corroboratedQuiet
tavily-api-key-cli-and-prefix-prosetavily · prose-mentionMust not flagT3 · Project policyQuiet
tavily-api-key-cli-login-reference-referencetavily · templated-referenceMust not flagT3 · Project policyQuiet
tavily-api-key-dev-ellipsis-placeholdertavily · documentation-placeholderMust not flagT3 · Project policyQuiet
tavily-api-key-dev-word-run-near-misstavily · format-near-missMust not flagT2 · Tool-corroboratedQuiet
tavily-api-key-docs-url-public-idtavily · public-identifierMust not flagT2 · Tool-corroboratedQuiet
tavily-api-key-embedded-leading-twintavily · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
tavily-api-key-env-reference-referencetavily · templated-referenceMust not flagT3 · Project policyQuiet
tavily-api-key-hyphen-in-body-twintavily · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
tavily-api-key-key-name-public-idtavily · public-identifierMust not flagT2 · Tool-corroboratedQuiet
tavily-api-key-label-prosetavily · benign-lookalikeMust not flagT3 · Project policyQuiet
tavily-api-key-long-body-twintavily · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
tavily-api-key-masktavily · benign-lookalikeMust not flagT3 · Project policyQuiet
tavily-api-key-prefix-onlytavily · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
tavily-api-key-prefix-only-near-misstavily · format-near-missMust not flagT2 · Tool-corroboratedQuiet
tavily-api-key-referencetavily · benign-lookalikeMust not flagT3 · Project policyQuiet
tavily-api-key-request-id-public-idtavily · public-identifierMust not flagT2 · Tool-corroboratedQuiet
tavily-api-key-short-bodytavily · benign-lookalikeMust not flagT2 · Tool-corroboratedQuiet
tavily-api-key-short-body-near-misstavily · format-near-missMust not flagT2 · Tool-corroboratedQuiet
tavily-api-key-short-body-twintavily · wrong-lengthMust not flagT2 · Tool-corroborated · twinQuiet
tavily-api-key-underscore-delimiter-twintavily · boundary-violationMust not flagT2 · Tool-corroborated · twinQuiet
tavily-api-key-underscore-in-body-twintavily · wrong-alphabetMust not flagT2 · Tool-corroborated · twinQuiet
tavily-api-key-x-run-placeholdertavily · documentation-placeholderMust not flagT3 · Project policyQuiet

Sources

Researched 2026-09-27.

Documentation and code

  • docs.tavily.com/documentation/api-reference/introduction
  • docs.tavily.com/documentation/enterprise/generate-keys
  • github.com/praetorian-inc/noseyparker/blob/17e2b1380cd3fc36968a86295aa4490fd1baab03/crates/noseyparker/data/default/builtin/rules/tavily.yml