Skip to content
Benchmarks

redact-secret · Report

API key (pa- or al-)

Voyage AI platform key (pa-) and MongoDB Atlas model API key (al-, al-eu-, al-us-); a 43-character [A-Za-z0-9_-] body rests on one scanner rule with no cited origin.

  • Voyage AI
  • Detectors: none mapped
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictIssuance-gated
  • Dossier evidence levelT2 · Tool-corroborated
  • Dossier researched2026-09-29
Beta.10 research disposition (redact-secret#785, benchmarks #384): pending, no corpus. The only body evidence is one betterleaks rule and community pages, no issued key confirms it, and pa- and al- are common two-letter prefixes, so a bare rule has low precision. Named-assignment, Bearer, JSON, YAML and tool-call forms are already redacted by the generic paths; revisit after the hands-on issuance the research comment lists.

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateDraft, not reviewed
  • Format revision1 · proposed, none current
  • ResearchResearched
  • Researched2026-09-29

What blocks the research

  • Issuance-gatedEvery 43-character body source traces to MongoDB. al- needs ruling Q-VO1 or Q-VO2, pa- needs Q-VO2 or one dashboard key; al-eu- needs one EU-scoped key in any case (checklists in redact-secret#1013).

2 events in the review history: 1 observed, 1 reviewed. Latest: observed on 2026-09-29 by automation, project maintainer. Project-maintained review is not independent validation. The family record at this release.

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

What it looks like

Shape not recorded.

Format facts

Open questions

No open question is recorded for this revision.

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
standalone keys start pa-; Atlas keys start al-, with region-scoped variants (al-eu- is documented; al-us- is not stated anywhere found). The provider says prefixes "encode the scope". Its "can't exceed 250 characters" is the limit on a key's name (name: maxLength: 250 in the Atlas Admin API schema), not on the key; an earlier reading here took it as a key-length ceiling (corrected by redact-secret#1013). The candidate body is 43 characters of [A-Za-z0-9_-] (46 in all for the unscoped forms), gated on a Voyage name, host or SDK context.
Basis
T1 for both prefixes: the Python SDK routes al- keys to https://ai.mongodb.com/v1, and MongoDB's own pipeline tests (2026-09-11) state that dashboard keys begin pa- and Atlas keys begin al-; MongoDB's docs (2026-09-01) state al-eu- for EU-scoped keys. For the body, redact-secret#1013 found the Atlas Admin API OpenAPI example (AiModelApiKeyResponse, 2026-07-14): one full-length al- + 43 alphanumeric value, with maskedSecret al- + **** + 4. The betterleaks rule (PR #324, 2026-08-31) and Kingfisher's native rules (pa- 2025-12-05, al- 2026-05-18) were written by a MongoDB engineer who says so in the PR, so every body source is one MongoDB voice and the corroborated route fails for want of a third independent owner. Third-party code checks the pa- prefix only.
Issuance
not attempted. The #785 checklist covers one standalone key and one Atlas key: prefix, body length, _ and -, region-scoped variants, masked list view and signup-issued keys.
Contract in core
none recorded; #785 concluded pending. Named assignment, Bearer, JSON, YAML and tool-call forms were measured as covered by generic paths, and the one-line SDK-call miss is a generic gap. See detector-families.md.

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.

No fixtures in this family yet

Nothing in the corpus targets it, so nothing is measured and no coverage is claimed.

Not measured

Benchmark dossier questions

Things the sources do not settle. They are listed so nobody reads them as settled.
Blocked by
Every 43-character body source traces to MongoDB. al- needs ruling Q-VO1 or Q-VO2, pa- needs Q-VO2 or one dashboard key; al-eu- needs one EU-scoped key in any case (checklists in redact-secret#1013).

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
pa- and al- are common two-letter prefixes (slugs, al- transliterations), and a 43-character base64url value matches a SHA-256 digest. Placeholders such as pa-your-key-here and model names like voyage-3 are benign. Key ids and names are public.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

No peer rule maps to this family

None of the reviewed peer scanners has a rule that can match a credential of this family.

None mapped

0 of 0 rows

No fixtures in this family yet

Nothing in the corpus targets it, so nothing is measured and no coverage is claimed.

Not measured

Sources

Researched 2026-09-29.

Documentation and code

  • www.mongodb.com/docs/voyageai/management/api-keys/
  • github.com/voyage-ai/voyageai-python/blob/cf6b295b691f4923946cd13fd8c2efdd9344d74a/voyageai/util.py
  • github.com/redact-secret/redact-secret/issues/785
  • github.com/betterleaks/betterleaks/blob/2bc07526bd83d8402bed0f7991c4d3e60f345af3/cmd/generate/config/rules/voyageai.go
  • github.com/mongodb/openapi/blob/5e6f651422c9ac9efd2ad21eba8a4256c38af864/openapi/v2.yaml#L1781-L1798
  • github.com/mongodb/docs/blob/2fdb2535da7d5595a9974569f1e7b981b797cd45/content/voyageai/source/management/api-keys.txt#L119-L121
  • github.com/mongodb-labs/ai-ml-pipeline-testing/blob/dce1cd9ec156d602b7af040678bcb022bbbf1159/.evergreen/utils.sh#L134-L146

Research log