secret.provider_token
A named provider's own credential format — AWS, GitHub, Stripe, Slack, and ~215 more — appears in the text.
One of gitleaks’ ~219 named-provider rules — the specific one rides in data.matches[].rule, e.g. "github-pat", "stripe-access-token".
What it looks at#
Each rule matches one provider’s own token shape — a fixed prefix (ghp_, sk_live_,
AKIA, …), a fixed length, or both — the same rules gitleaks ships by default, run
unchanged. Most also carry a keyword prefilter and a Shannon-entropy floor on the matched
value, so a token-shaped string that isn’t actually random enough to be a real credential
doesn’t fire.
Why it matters#
A recognisable provider format is a real, working credential shape — one step below a private key, since it authenticates against a specific service rather than everything the key touches, but immediately usable there without any further step.
What to do#
High severity. Rotate the credential at the named provider and check that provider’s own
access logs for use you don’t recognise. data.matches[].rule tells you which provider’s
format matched, so you don’t have to guess from the message alone. We never test the value
against the provider ourselves — see /v1/secrets for why.
What it leaves to other checks#
JWTs are secret.jwt, Stripe sk_test_/rk_test_ keys are
secret.test_mode_token, and publishable keys emit
nothing. GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_) carry a CRC32 checksum in
their last six characters; a token whose checksum does not verify is a fake or a
placeholder and is not reported. Placeholder values (EXAMPLE, xxxx, <...>, shell-variable references,
your_..., REDACTED, repeated or sequential characters) are skipped by every check in
this gate.