If you are prefixing it, why not prefix it with a full domain name? mycompany_com_BRTRKFsL_51FwqftsmMDHHbJAMEXXHCgG is not much longer than mycompany_BRTRKFsL_5

If you are prefixing it, why not prefix it with a full domain name? mycompany_com_BRTRKFsL_51FwqftsmMDHHbJAMEXXHCgG is not much longer than mycompany_BRTRKFsL_51FwqftsmMDHHbJAMEXXHCgG and allows reporting leaked secrets (for example using the GitHub scheme [1]) without having to look up the URL in some sort of registry, e.g. POST https://mycompany.com/.well-known/report-leaked-secrets https://mycompany.com/.well-known/report-leaked-secrets [1]: https://docs.github.com/en/developers/overview/secret-scanning-partner-program#create-a-secret-alert-service https://docs.github.com/en/developers/overview/secret-scanni... edit: See also the discussion from last time: https://news.ycombinator.com/item?id=28296864 https://news.ycombinator.com/item?id=28296864