Hacker News Reader

You're definitely on to something.

I know (personal) Github API tokens use a prefix of ghp_ and the Github-app JWT-issued tokens have another prefix (maybe gha_? Can't remember)

As mentioned recently here on HN, a generalized version of this technique is what RFC8959[1] proposes via "secret-token" prefix.

Do add these to all your pre-commit hooks and other password detectors/log analysers!

This is precisely why github switched their token format and what they recommend other service providers do:

I agree, some do but more should dare I say need to follow suit.