redact-secret · Report
App refresh token
Modern Vercel App refresh token identified by the provider-documented vcr_ marker.
Beta.12 arrival family vercel-app-refresh-token scored by finding type (benchmarks/lib/beta8/1012e.ts; #1013 record, T2: vcr_ + exactly 56 [A-Za-z0-9]). Product redact-secret#1036 types it inside the shared vercel-token detector under its own finding type, recorded in scanners/families.mjs arrivalFindingTypes. The base62 CRC-32 suffix is unresolved and never enforced; the vercel:access-token aggregate measurement is not attributed to this family.
Research record
From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
Format revisions
- Revision 1
vercel:app-refresh-token@1current · draft, not reviewed · superseded by @2 · the family's current revision - Revision 2
vercel:app-refresh-token@2proposed · draft, not reviewed · supersedes @1
5 events in the review history: 1 authored, 3 observed, 1 reviewed. Latest: observed on 2026-10-06 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.
Format
Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.
What it looks like
- Descriptive pattern
^vcr_[A-Za-z0-9]{56}$
Parts are shown as recorded. Evidence classes belong to the facts below; no class is assigned to a part.
Format facts
Tool corroborated ·
tool-corroboration· current · observed 2026-09-29Pinned scanner rules are consistent with the contract grammar (2 artifacts: betterleaks; kingfisher).
- betterleaks/betterleaks @ 2a387a5bad4290a84b9a1eb679bffe70611218cc: cmd/generate/config/rules/vercel.goscanner-rule-source · last read 2026-10-06 · latest outcome read · supports betterleaks: vc[pikar]_ + 56 [A-Za-z0-9_-] (derived from kingfisher) · #L46-L212
- mongodb/kingfisher @ 88d3f780fad83960aaddfcf732a690049853ccc9: crates/kingfisher-rules/data/rules/vercel.ymlprovider-documentation · last read 2026-10-06 · latest outcome read · supports kingfisher: vc[pikar]_ + 50 [A-Za-z0-9_-] + 6 [A-Za-z0-9] (Base62 CRC-32 tail); its vca_/vcr_ examples copy the Vercel docs value · #L46-L299
Provider documented ·
field-prefix· current · observed 2026-09-29prefix: vcr_
- openapi.vercel.shprovider-documentation · last read 2026-09-29 · latest outcome read · supports tokenPrefix enum
- vercel.com/docs/sign-in-with-vercel/authorization-server-apiprovider-documentation · last read 2026-10-06 · latest outcome read · supports vcr_ with the underscore
- vercel.com/changelog/new-token-formats-and-secret-scanningprovider-documentation · last read 2026-10-06 · latest outcome read · supports marker stem vcr
Provider documented ·
field-body· current · observed 2026-09-29body: exactly 56 [A-Za-z0-9] (60 in all) (T2 (thin: one provider value, copied by both peers).)
- mongodb/kingfisher @ 88d3f780fad83960aaddfcf732a690049853ccc9: crates/kingfisher-rules/data/rules/vercel.ymlprovider-documentation · last read 2026-10-06 · latest outcome read · supports body: exactly 56 [A-Za-z0-9] (60 in all) · #L46-L299
- vercel.com/docs/sign-in-with-vercel/tokensprovider-documentation · last read 2026-10-06 · latest outcome read · supports Sign in with Vercel tokens page: vcr_ + the vca_ example body (no independent vcr_ body)
Provider documented ·
field-alphabet-bound· current · observed 2026-09-29alphabet-bound: _ and - are not in the body (Bounded by the record (every provider example is alphanumeric); a body with _ or - is an alphabet twin.)
- mongodb/kingfisher @ 88d3f780fad83960aaddfcf732a690049853ccc9: crates/kingfisher-rules/data/rules/vercel.ymlprovider-documentation · last read 2026-10-06 · latest outcome read · supports admits _ and - in the first 50 · #L46-L299
- vercel/vercel-azure-devops-extension @ 24183cd1671cdb451e22a20634c2bb19e3478870: vercel-deployment-task-source/src/index.tsprovider-documentation · last read 2026-10-06 · latest outcome read · supports the masker admits _ and -, with no length · #L37-L38
- vercel.com/docs/sign-in-with-vercel/tokensprovider-documentation · last read 2026-10-06 · latest outcome read · supports alphabet-bound: _ and - are not in the body
Unresolved ·
field-checksum· current · observed 2026-09-29checksum: the last 6 characters may be base62 (0-9A-Za-z) of the CRC-32 of the 50 before them (Not enforced and never a twin: positives carry a matching and a mismatching tail.)
- openapi.vercel.shprovider-documentation · last read 2026-09-29 · latest outcome read · supports tokenSuffix: "The token checksum suffix."
- vercel.com/docs/cli/global-optionsprovider-documentation · last read 2026-10-06 · latest outcome read · supports the vcp_ example fails it
- vercel.com/docs/sign-in-with-vercel/tokensprovider-documentation · last read 2026-10-06 · latest outcome read · supports the vca_ example passes it
Provider documented ·
field-sibling-classes· current · observed 2026-09-29sibling-classes: vci_ and vck_ are other Vercel classes, STILL-BLOCKED on the body (Q-VC); the legacy unprefixed 24-character token is excluded (Neither a positive nor a control.)
- redact-secret/redact-secret @ 4fb78827f1ddf5b3106f25130ca510a836ada186: docs/audits/evidence/1013/vercel.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports verdict table
- vercel.com/changelog/new-token-formats-and-secret-scanningprovider-documentation · last read 2026-10-06 · latest outcome read · supports sibling-classes: vci_ and vck_ are other Vercel classes, STILL-BLOCKED on the body (Q-VC); the legacy unprefixed 24-character token is excluded
Tool corroborated ·
field-peer-lag· current · observed 2026-09-29peer-lag: no prefixed Vercel rule in gitleaks 8.30.1; trufflehog 3.97.4 reads only the legacy unprefixed 24-character contextual token
- gitleaks/gitleaks @ v8.30.1: config/gitleaks.tomlscanner-rule-source · last read 2026-10-04 · latest outcome read · supports no vercel rule
- trufflesecurity/trufflehog @ v3.97.4: pkg/detectorsscanner-rule-source · last read 2026-09-29 · latest outcome read · supports peer-lag: no prefixed Vercel rule in gitleaks 8.30.1; trufflehog 3.97.4 reads only the legacy unprefixed 24-character contextual token
- trufflesecurity/trufflehog @ v3.97.4: pkg/detectors/vercel/vercel.goscanner-rule-source · last read 2026-10-03 · latest outcome read · supports legacy 24-character pattern
Unresolved ·
listed-references· current · observed 2026-09-29The legacy contract lists 16 references without stating which property each supports.
- betterleaks/betterleaks @ 2a387a5bad4290a84b9a1eb679bffe70611218cc: cmd/generate/config/rules/vercel.goscanner-rule-source · last read 2026-10-06 · latest outcome read · supports Listed as a reference by the legacy contract · #L46-L212
- mongodb/kingfisher @ 88d3f780fad83960aaddfcf732a690049853ccc9: crates/kingfisher-rules/data/rules/vercel.ymlprovider-documentation · last read 2026-10-06 · latest outcome read · supports Listed as a reference by the legacy contract · #L46-L299
- redact-secret/redact-secret @ 4fb78827f1ddf5b3106f25130ca510a836ada186: docs/audits/evidence/1013/README.mdproject-research-note · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret/issues/860issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #issuecomment-5871306275
- github.com/redact-secret/redact-secret-benchmarks/issues/528issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret/issues/1013issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- redact-secret/redact-secret @ 4fb78827f1ddf5b3106f25130ca510a836ada186: docs/audits/evidence/1013/vercel.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- github.com/redact-secret/redact-secret/issues/1036issue-or-discussion · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- Samsung/CredSweeper @ 1aa60465c4ec064357ead06f5b4da7c3adbce7a8: credsweeper/rules/config.yamlprovider-documentation · last read 2026-10-06 · latest outcome read · supports Listed as a reference by the legacy contract · #L1995-L2007
- vercel/turborepo @ 07ee4185589823c984ea9f28d1f8480b60d6374f: crates/turborepo-auth/src/auth/mod.rsother · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract · #L361
- vercel/vercel-azure-devops-extension @ 24183cd1671cdb451e22a20634c2bb19e3478870: vercel-deployment-task-source/src/index.tsprovider-documentation · last read 2026-10-06 · latest outcome read · supports Listed as a reference by the legacy contract · #L37-L38
- openapi.vercel.shprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a reference by the legacy contract
- vercel.com/docs/sign-in-with-vercel/authorization-server-apiprovider-documentation · last read 2026-10-06 · latest outcome read · supports Listed as a reference by the legacy contract
- vercel.com/changelog/new-token-formats-and-secret-scanningprovider-documentation · last read 2026-10-06 · latest outcome read · supports Listed as a reference by the legacy contract
- vercel.com/docs/accounts/access-tokensprovider-documentation · last read 2026-10-06 · latest outcome read · supports Listed as a reference by the legacy contract
- vercel.com/docs/sign-in-with-vercel/tokensprovider-documentation · last read 2026-10-06 · latest outcome read · supports Listed as a reference by the legacy contract
Tool corroborated ·
dossier-research· current · observed 2026-09-29Legacy dossier research (verdict ready, tier T2) cited 8 sources; the dossier does not attribute sources to individual properties.
- github.blog/changelog/2026-03-10-secret-scanning-pattern-updates-march-2026/other · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family
- betterleaks/betterleaks @ 2a387a5bad4290a84b9a1eb679bffe70611218cc: cmd/generate/config/rules/vercel.goscanner-rule-source · last read 2026-10-06 · latest outcome read · supports Cited by the legacy dossier research for this family · #L148-L181
- mongodb/kingfisher @ 88d3f780fad83960aaddfcf732a690049853ccc9: crates/kingfisher-rules/data/rules/vercel.ymlprovider-documentation · last read 2026-10-06 · latest outcome read · supports Cited by the legacy dossier research for this family · #L193-L251
- redact-secret/redact-secret @ add1188fed9993723c59fbce8c867086b9d2049a: docs/audits/evidence/1013/vercel.mdproject-research-note · last read 2026-09-29 · latest outcome read · supports Final research evidence recorded by the legacy dossier
- vercel/vercel @ c628be7835e03a965b93e9cf9e2bd5ac2acbf5eb: packages/cli/test/unit/util/login/token-refresh.test.tsprovider-sdk-source · last read 2026-09-29 · latest outcome read · supports Cited by the legacy dossier research for this family · #L115-L125
- vercel.com/docs/sign-in-with-vercel/authorization-server-apiprovider-documentation · last read 2026-10-06 · latest outcome read · supports Cited by the legacy dossier research for this family
- vercel.com/changelog/new-token-formats-and-secret-scanningprovider-documentation · last read 2026-10-06 · latest outcome read · supports Cited by the legacy dossier research for this family
- vercel.com/docs/sign-in-with-vercel/tokensprovider-documentation · last read 2026-10-06 · latest outcome read · supports Cited by the legacy dossier research for this family
Unresolved ·
taxonomy-sources· current · observed 2026-09-29The legacy taxonomy lists 3 sources for this family. The taxonomy records no date; the dossier researchedAt is used as the observed-at date.
- redact-secret/redact-secret @ 4fb78827f1ddf5b3106f25130ca510a836ada186: docs/audits/evidence/1013/vercel.mdprovider-documentation · last read 2026-09-29 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy
- vercel.com/changelog/new-token-formats-and-secret-scanningprovider-documentation · last read 2026-10-06 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy
- vercel.com/docs/sign-in-with-vercel/tokensprovider-documentation · last read 2026-10-06 · latest outcome read · supports Listed as a source for this family in the legacy taxonomy
Open questions
No open question is recorded for this revision.
Benchmark dossier notes
From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
- Shape
vcr_plus 56 characters. The docs example reuses thevca_body, so it is not a second body observation. Refresh tokens last 30 days and rotate on use.
In this benchmark
Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.
- Fixtures
- 40
- Left readable
- 0
- Redacted too much
- 0
- False alarms
- 1
40 fixtures: 18 expect a redaction, 22 must stay quiet. See every row
| Evidence level | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| T2Tool-corroborated | 28 | 0 | 0 | 1 |
| T3Project policy | 9 | 0 | 0 | 0 |
| T0Pending review | 3 | 0 | 0 | 0 |
Every scanner on the same fixtures
In run order. Counts are what each scanner recorded on this family's fixtures, whichever rules it has; a scanner with no rule for the family has nothing to report on it.
| Scanner | Fixtures | Left readable | Too much | False alarms |
|---|---|---|---|---|
| flare-redactRuntime library · 1.6.1 · Published npm package · secrets-only (pii, generic_assignment disabled) · JavaScript engineNo rule maps to it | 40 | 17 | 1 | 0 |
| gitleaksRepository scanner · 8.30.1 · Directory scan · default rulesNo rule maps to it | 40 | 6 | 0 | 0 |
| redact-secretProduct measured here · 0.1.0-beta.14 · Published npm package · default detectors1 detector mapped | 40 | 0 | 0 | 1 |
| trufflehogRepository scanner · 3.97.4 · Filesystem scan · verification disabledNo rule maps to it | 40 | 18 | 0 | 0 |
Scanner rules for this family
Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.
No peer rule maps to this family
None of the reviewed peer scanners has a rule that can match a credential of this family.
None mapped
Fixtures in this family
40 rows, redact-secret's outcome on each. Rows that need a look come first (1), then the rest in corpus order. Choose "Every scanner" to see each scanner's outcome for the same rows.
| Fixture | Kind and evidence | redact-secret |
|---|---|---|
vercel-app-refresh-token-body-55-twinvercel · wrong-length | Must not flagT2 · Tool-corroborated · twin | Flagged |
vercel-app-refresh-token-bare-prosevercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-bearer-headervercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-chat-pastevercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-debug-logvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-docker-envvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-dotenvvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-exportvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-json-api-keyvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-json-tokenvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-python-dictvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-refresh-bodyvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-refresh-curlvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-sdk-kwargvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-session-storevercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-suffix-mismatch-dotenvvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-suffix-mismatch-logvercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-token-responsevercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-x-api-key-headervercel · documented-format-literal | Must redactT2 · Tool-corroborated | Redacted |
vercel-app-refresh-token-actions-secret-referencevercel · templated-reference | Must not flagT3 · Project policy | Quiet |
vercel-app-refresh-token-angle-placeholdervercel · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
vercel-app-refresh-token-body-57-twinvercel · unsettled-evidence-input | Pending reviewT0 · Pending · twin | Unscored |
vercel-app-refresh-token-deployment-id-public-idvercel · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
vercel-app-refresh-token-deployment-url-public-idvercel · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
vercel-app-refresh-token-ellipsis-placeholdervercel · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
vercel-app-refresh-token-env-reference-referencevercel · templated-reference | Must not flagT3 · Project policy | Quiet |
vercel-app-refresh-token-hyphen-in-body-twinvercel · unsettled-evidence-input | Pending reviewT0 · Pending · twin | Unscored |
vercel-app-refresh-token-hyphen-separator-twinvercel · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
vercel-app-refresh-token-leading-glue-twinvercel · boundary-violation | Must not flagT2 · Tool-corroborated · twin | Quiet |
vercel-app-refresh-token-marker-in-identifier-near-missvercel · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
vercel-app-refresh-token-marker-without-underscore-twinvercel · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
vercel-app-refresh-token-masked-placeholdervercel · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
vercel-app-refresh-token-prefix-table-prosevercel · prose-mention | Must not flagT3 · Project policy | Quiet |
vercel-app-refresh-token-process-env-referencevercel · templated-reference | Must not flagT3 · Project policy | Quiet |
vercel-app-refresh-token-team-and-project-ids-public-idvercel · public-identifier | Must not flagT2 · Tool-corroborated | Quiet |
vercel-app-refresh-token-token-guidance-prosevercel · prose-mention | Must not flagT3 · Project policy | Quiet |
vercel-app-refresh-token-truncated-near-missvercel · format-near-miss | Must not flagT2 · Tool-corroborated | Quiet |
vercel-app-refresh-token-underscore-in-body-twinvercel · unsettled-evidence-input | Pending reviewT0 · Pending · twin | Unscored |
vercel-app-refresh-token-uppercase-prefix-twinvercel · prefix-near-miss | Must not flagT2 · Tool-corroborated · twin | Quiet |
vercel-app-refresh-token-x-run-placeholdervercel · documentation-placeholder | Must not flagT3 · Project policy | Quiet |
Sources
Researched 2026-09-29.
Documentation and code
- vercel.com/changelog/new-token-formats-and-secret-scanning
- vercel.com/docs/sign-in-with-vercel/tokens
- github.com/redact-secret/redact-secret/blob/4fb78827f1ddf5b3106f25130ca510a836ada186/docs/audits/evidence/1013/vercel.md
- vercel.com/docs/sign-in-with-vercel/authorization-server-api
- github.com/vercel/vercel/blob/c628be7835e03a965b93e9cf9e2bd5ac2acbf5eb/packages/cli/test/unit/util/login/token-refresh.test.ts#L115-L125
- github.com/mongodb/kingfisher/blob/88d3f780fad83960aaddfcf732a690049853ccc9/crates/kingfisher-rules/data/rules/vercel.yml#L193-L251
- github.com/betterleaks/betterleaks/blob/2a387a5bad4290a84b9a1eb679bffe70611218cc/cmd/generate/config/rules/vercel.go#L148-L181
- github.blog/changelog/2026-03-10-secret-scanning-pattern-updates-march-2026/
Research log
- redact-secret/redact-secret#858Research issue
- redact-secret/redact-secret#516Research issue
- redact-secret/redact-secret-benchmarks#367Research issue
- redact-secret/redact-secret-benchmarks#373Research issue
- redact-secret/redact-secret-benchmarks#473Research issue
- redact-secret/redact-secret#1013Research issue
- Final evidence, pinned to a commit/redact-secret/redact-secret/blob/add1188fed9993723c59fbce8c867086b9d2049a/docs/audits/evidence/1013/vercel.md