Skip to content
Benchmarks

redact-secret · Report

API key (xau_, xao_)

xau_ (user) or xao_ (organization) + a base62 body of 20 random bytes plus a CRC32; the validator caps the key at 40 characters.

  • Xata
  • Detectors: xata-api-key
  • Run 2026-10-07
  • Mode published · redact-secret 0.1.0-beta.14
All providers
  • Dossier verdictReady
  • Dossier evidence levelT1 · Provider-documented
  • Dossier researched2026-09-30
Registered in the product at the 3b1a5aa re-pin (redact-secret PR #1214, unreleased), with a benchmark contract and a seeded corpus (#583, `beta8-583b`); the claim stays provisional until the conformance and arrival gates and the open ruling questions settle. Not a support claim. Handoff xata.md (READY).

Research record

From credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0. It describes the research on the format, not what any scanner or the product does, and not a support status.
  • Review stateNot recorded
  • Format revisionNot recorded
  • ResearchNot recorded
  • ResearchedNot recorded

No research record for this family

snapshot-2026.10.06.4 has no family record for xata:api-key, so its review state, format revision and format facts are not recorded here.

Not recorded

Format

Provider format research from credential-evidence snapshot-2026.10.06.4 · records at 77ce761 · schema 1.8.0.

Format not recorded

No format contract is recorded for this family in the pinned release.

Not recorded

Benchmark dossier notes

From the provider dossier, as written. The evidence level above says how well the format is backed; a fact the dossier does not record is not shown.
Shape
xau_/xao_ + a bit-packed base62 body (20 random bytes plus a little-endian CRC32); the validator caps the key at 40 characters.
Basis
T1 (provider code, R1 and R9): xataio/xata key.go and the jxskiss/base62 encoder it calls fix the prefix, the [0-9A-Za-z] alphabet and the 40-character cap; the 32 to 36 body width is derived from the encoder (99.9% of keys are 32 to 34). READY. Contract and seeded corpus authored in #583 (benchmarks/lib/beta8/583b.ts, fixtures/generated/beta8/583b.mjs). The CRC32 is policy (ruling Q1, open), so checksum-mismatch twins are unclaimed; the 35 and 36 widths are an inclusion decision and their positives are lexical-only. No pinned peer has a Xata rule.
Issuance
not attempted; the handoff records no issuance gate.
Contract in core
detector-families.md (the detector xata-api-key is registered on main, redact-secret#1102, unreleased). One registry contract covers both finding types (xata_user_api_key, xata_organization_api_key); no second arrival family.

In this benchmark

Fixture rows on the current run. Counts are for redact-secret in published · redact-secret 0.1.0-beta.14 mode.

No fixtures in this family yet

Nothing in the corpus targets it, so nothing is measured and no coverage is claimed.

Not measured

Looks like it, but isn't

Values the dossier records as resembling this credential without being one.
Collisions
see the handoff's excluded shapes.

Scanner rules for this family

Mapped by hand (reviewed 2026-09-30) from each scanner's pinned rule file, never from what a scanner found on the fixtures.

No peer rule maps to this family

None of the reviewed peer scanners has a rule that can match a credential of this family.

None mapped

0 of 0 rows

No fixtures in this family yet

Nothing in the corpus targets it, so nothing is measured and no coverage is claimed.

Not measured

Sources

Researched 2026-09-30.

Documentation and code

  • github.com/redact-secret/redact-secret/blob/3b1a5aa9935c57416a026a44f45501fd41ffeac8/docs/audits/evidence/1014/xata.md
  • github.com/xataio/xata/blob/fc4ac97f62a3830c4e4202b08a3ca51855970113/internal/api/key/key.go#L19-L57

Research log