New regex patterns for detecting secrets that should not be committed or synced:
- GitHub personal access tokens (
github_pat_\w{82}) - PyPI API tokens (
pypi-AgEIcHlwaS5vcmc) - Slack xapp tokens (
xapp-\d-[A-Z0-9]+-\d+-[a-z0-9]+)
Evidence
Token patterns (search for "github_pat_")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.