Hacker News Reader

Using a domain name would have been enough, e.g.

secret-token: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

vs

secret-token:sendgrid.com/wQsmLe_tnOiByt8JUO4Kro.S_kyH0U2yBC54LHXoUoI4ppe3T5SFsiNmcWiu4xaVt0

Then you could even standardize that scanners should use sendgrid.com/.well-known/revoke-token to notify of secret tokens found in the wild.

The stated purpose is to allow detection of strings that should not be publicly disclosed. If such string would also plainly identify what it is good for it would essentially defeat the purpose. Ie. the authors want to encourage creation of automated tools that prevent disclosure of such tokens, not encourage creation of automated tools that will harvest such tokens from publicly accessible data.

Yes, but there's also value in services automatically revoking leaked credentials, which is made easier by including such an identifier.

The purpose is to detect secret strings in source code. If you have the source code, the purpose of the secret is easy to figure out.

Couldn’t you protect against that with something like com-amazon-secret-token?