The secret scanner's bundled patterns know OpenAI's sk-proj- and sk-svcacct- keys but not its sk-admin- admin keys, the third prefix gitleaks' openai-api-key rule names (cmd/generate/config/rules/openai.go: sk-(?:proj|svcacct|admin)-...). An admin key reaches no bundled pattern: the plain sk- rule cannot match it either, since 'admin' is followed by '-'. Every store-before-commit redactor, the launch scan and the guided connect's key check share the gap.

The secret scanner's bundled patterns know OpenAI's sk-proj- and sk-svcacct- keys but not its sk-admin- admin keys, the third prefix gitleaks' openai-api-key rule names (cmd/generate/config/rules/openai.go: sk-(?:proj|svcacct|admin)-...). An admin key reaches no bundled pattern: the plain sk- rule cannot match it either, since 'admin' is followed by '-'. Every store-before-commit redactor, the launch scan and the guided connect's key check share the gap.

Grounds

• pursued: an sk-admin- key is reported as token:openai_admin and masked by every redactor; shown wrong by such a key passing the scanner, or by a committed non-key it flags (git grep finds no sk-admin- in the tree).