Unlisted, Not Private
A full sweep of 33 public attack surfaces turned up 23,912 machine credentials that still work. We graded each by the privilege it carries, and 1,277 of them survive revocation of the leaked key.
8 min readRead
Non-Human Identity Security PlatformStop counting secrets.
Stop counting secrets.
Fix live keys first.
Cremit finds the API keys and service-account credentials scattered across your code, cloud storage, collaboration tools and approved external assets, checks which exposed ones still work, and puts those at the top of your queue, so machine identity risk becomes a number you watch come down, not a pile you dig through.
See the product tour, no sales callTrusted by security teams from leading startups to enterprises
1,000+
Credential types detected and verified
10
Sources scanned, connected in minutes
10m
Minute re-verification of every live secret
In plain terms
What is non-human identity (NHI) security?
Non-human identity (NHI) security is the practice of discovering, verifying and controlling the credentials that software uses to authenticate: API keys, service accounts, access tokens, SSH keys and database passwords. It is also called machine identity security. Unlike human accounts, these identities rarely have an owner, an expiry date or MFA, so a leaked credential can be used silently for months. NHI security tooling builds an inventory of these identities, detects where they are exposed, checks whether an exposed credential still works, and drives rotation or revocation.
What is Cremit?
Cremit is a non-human identity (NHI) security platform built by Cremit Inc, a Seoul-based company founded in 2023. Its product, Cremit Platform, connects to code repositories, cloud storage and collaboration tools such as GitHub, GitLab, AWS S3, Google Drive, Slack, Jira, Confluence and Notion, finds exposed API keys, service account credentials and tokens, and verifies every finding against the service that issued it. Security teams use it to fix the credentials that still work first instead of triaging thousands of pattern matches.
How Cremit works
- 01
Connect a source.
Link GitHub, GitLab, AWS S3, Google Drive, Slack, Jira, Confluence or Notion with OAuth or a token. No agents to install.
- 02
Scan and verify.
Cremit Platform scans files, commit history, documents and messages for credential patterns, then checks each match against the issuing service to see whether it still authenticates.
- 03
Fix live keys first.
Live findings are ranked and sent to Slack, a webhook, Telegram or email with location and owner context. You rotate or revoke; Cremit Platform re-verifies until the key no longer works.
The Problem
Secret sprawl is
killing your velocity.
Hardcoded keys, leaked tokens, and no way to tell which ones still work. Your team wastes time on firefighting and credential triage instead of shipping features.
Source Code
Hardcoded AWS key detected
in main branch
AKIA...LEAKED...29A
Critical Alert: Secret Exposed
Manual rotation required ASAP
Automated
Verified live, owner alerted & incident opened
One leaked secret
destroys trust.
A single exposed credential can compromise your entire infrastructure. Don't let manual management become your vulnerability.
- !Immediate Data Exfiltration
Attackers exploit leaked keys within minutes.
- !Unauthorized Access & Privilege Escalation
Compromised credentials let attackers access your entire system.
- !Reputation Damage
Customer trust lost, years to recover.
Average breach cost
$4.88M
+10% YoY (IBM 2024)
Active secret detected
AWS access key in a public repo is still live
From discovery to incident response
Cremit covers discovery, live verification, blast-radius analysis for AWS and GCP keys, and incident response for your NHIs, so your team starts with the keys that still work.
Free plan to start, no credit card. Enterprise pricing on request.
Connect the tools you already use
Connect GitHub, Slack, Confluence, Notion and AWS S3 in minutes, plus GitLab, Bitbucket, Jira and Google Drive. Cremit builds one inventory of every credential it finds across them, so there is a single place to check.
IntegrationsAll Systems Operational
GitHub
Connected
124 Repos
AWS S3
Connected
52 Buckets
Slack
Connected
14 Workspaces
Notion
Connected
890 Pages
Confluence
Connected
Syncing...
Indexing assets...
Screenshots show illustrative data, not customer metrics.
Discovered SecretsLive Verification
AWS Access Key
Verified active: 2m ago
Snowflake Access Token
Verified revoked: 12h ago
Legacy API Token
Older than 90 days, not rotated
RISK
Complete identity inventory
Cremit builds a continuously updated inventory of every secret and API key found across your code, chats, docs, cloud storage, approved external assets and AWS Secrets Manager.
Vault Sync
Fingerprint Match
Rotation Age Check
Rotation overdue: 2 secrets
90-day policyRotation age tracking
Stop tracking key age by hand. Cremit checks every secret in AWS Secrets Manager against your rotation policy and flags keys that are overdue or due soon.
~ gh pr create --head feature/payments
remote: pull request #418 opened
Cremit: pull request scan triggered...
[ACTIVE] Stripe Secret Key verified live
File: src/config/billing.ts:24
alert: incident #1042 opened, Slack notified
Continuous secret scanning
Detect hardcoded secrets in code, chats, docs and cloud storage on every scheduled scan and every GitHub pull request, and verify whether each one is live. Supports 1,000+ secret types.
Leaked AWS Key Detected
Source: public-repo/config.js
Now
Verified ACTIVE
Public Exposure Confirmed
Incident #1042
Security Team Notified
Incident #1042 Opened
Automated incident routing
Every live finding opens an incident, alerts your channel and lands with an owner, tracked to closure with MTTD and MTTR.
Screenshots show illustrative data, not customer metrics.
What customers say
See what customers say about finding and verifying leaked credentials with Cremit.
"As media infrastructure moves to the cloud, credential management becomes exponentially more complex. Cremit gave us the visibility we needed to secure our GitLab environment and protect the cloud infrastructure that serves millions of viewers every day."
OOO
Security Manager
""As a startup CEO wearing multiple hats, I didn't have time to manually check for exposed credentials. Cremit found AWS keys I didn't even know were at risk and let me secure them before anything happened.""
Woongab Jeong
CEO, Founder
"Before Cremit, we had no way of knowing where or how many credentials were exposed across our systems. Within a single day of deployment, we gained complete visibility into our entire environment, and every alert was a real threat — not a single false positive."
Daeyoung Jeong
Security Team Leader
"As a solo security lead at a growing commerce company, I couldn't keep up with credential management across all our platforms. Cremit gave me the visibility and automation I needed to do my job effectively — without asking for more headcount."
Jihoon Gong
Compliance Security Engineer
"As we prepared for ISMS certification, Cremit helped us identify Google Cloud service keys we didn't even know were exposed. Securing these credentials not only reduced our risk but gave us the documented evidence we needed for the audit."
Jinseok Yeo
Security Engineer
"Traditional vendors communicate via email or phone, but with Cremit we can quickly reach out through Slack Connect. Having a feature request implemented in just 15 minutes was truly impressive."
Jeongcheol Kang
Security Engineer
"As media infrastructure moves to the cloud, credential management becomes exponentially more complex. Cremit gave us the visibility we needed to secure our GitLab environment and protect the cloud infrastructure that serves millions of viewers every day."
OOO
Security Manager
""As a startup CEO wearing multiple hats, I didn't have time to manually check for exposed credentials. Cremit found AWS keys I didn't even know were at risk and let me secure them before anything happened.""
Woongab Jeong
CEO, Founder
"Before Cremit, we had no way of knowing where or how many credentials were exposed across our systems. Within a single day of deployment, we gained complete visibility into our entire environment, and every alert was a real threat — not a single false positive."
Daeyoung Jeong
Security Team Leader
"As a solo security lead at a growing commerce company, I couldn't keep up with credential management across all our platforms. Cremit gave me the visibility and automation I needed to do my job effectively — without asking for more headcount."
Jihoon Gong
Compliance Security Engineer
"As we prepared for ISMS certification, Cremit helped us identify Google Cloud service keys we didn't even know were exposed. Securing these credentials not only reduced our risk but gave us the documented evidence we needed for the audit."
Jinseok Yeo
Security Engineer
"Traditional vendors communicate via email or phone, but with Cremit we can quickly reach out through Slack Connect. Having a feature request implemented in just 15 minutes was truly impressive."
Jeongcheol Kang
Security Engineer
"As media infrastructure moves to the cloud, credential management becomes exponentially more complex. Cremit gave us the visibility we needed to secure our GitLab environment and protect the cloud infrastructure that serves millions of viewers every day."
OOO
Security Manager
""As a startup CEO wearing multiple hats, I didn't have time to manually check for exposed credentials. Cremit found AWS keys I didn't even know were at risk and let me secure them before anything happened.""
Woongab Jeong
CEO, Founder
"Before Cremit, we had no way of knowing where or how many credentials were exposed across our systems. Within a single day of deployment, we gained complete visibility into our entire environment, and every alert was a real threat — not a single false positive."
Daeyoung Jeong
Security Team Leader
"As a solo security lead at a growing commerce company, I couldn't keep up with credential management across all our platforms. Cremit gave me the visibility and automation I needed to do my job effectively — without asking for more headcount."
Jihoon Gong
Compliance Security Engineer
"As we prepared for ISMS certification, Cremit helped us identify Google Cloud service keys we didn't even know were exposed. Securing these credentials not only reduced our risk but gave us the documented evidence we needed for the audit."
Jinseok Yeo
Security Engineer
"Traditional vendors communicate via email or phone, but with Cremit we can quickly reach out through Slack Connect. Having a feature request implemented in just 15 minutes was truly impressive."
Jeongcheol Kang
Security Engineer
"As media infrastructure moves to the cloud, credential management becomes exponentially more complex. Cremit gave us the visibility we needed to secure our GitLab environment and protect the cloud infrastructure that serves millions of viewers every day."
OOO
Security Manager
""As a startup CEO wearing multiple hats, I didn't have time to manually check for exposed credentials. Cremit found AWS keys I didn't even know were at risk and let me secure them before anything happened.""
Woongab Jeong
CEO, Founder
"Before Cremit, we had no way of knowing where or how many credentials were exposed across our systems. Within a single day of deployment, we gained complete visibility into our entire environment, and every alert was a real threat — not a single false positive."
Daeyoung Jeong
Security Team Leader
"As a solo security lead at a growing commerce company, I couldn't keep up with credential management across all our platforms. Cremit gave me the visibility and automation I needed to do my job effectively — without asking for more headcount."
Jihoon Gong
Compliance Security Engineer
"As we prepared for ISMS certification, Cremit helped us identify Google Cloud service keys we didn't even know were exposed. Securing these credentials not only reduced our risk but gave us the documented evidence we needed for the audit."
Jinseok Yeo
Security Engineer
"Traditional vendors communicate via email or phone, but with Cremit we can quickly reach out through Slack Connect. Having a feature request implemented in just 15 minutes was truly impressive."
Jeongcheol Kang
Security Engineer
"As a solo security lead at a growing commerce company, I couldn't keep up with credential management across all our platforms. Cremit gave me the visibility and automation I needed to do my job effectively — without asking for more headcount."
Jihoon Gong
Compliance Security Engineer
"As we prepared for ISMS certification, Cremit helped us identify Google Cloud service keys we didn't even know were exposed. Securing these credentials not only reduced our risk but gave us the documented evidence we needed for the audit."
Jinseok Yeo
Security Engineer
"As media infrastructure moves to the cloud, credential management becomes exponentially more complex. Cremit gave us the visibility we needed to secure our GitLab environment and protect the cloud infrastructure that serves millions of viewers every day."
OOO
Security Manager
"Traditional vendors communicate via email or phone, but with Cremit we can quickly reach out through Slack Connect. Having a feature request implemented in just 15 minutes was truly impressive."
Jeongcheol Kang
Security Engineer
"Before Cremit, we had no way of knowing where or how many credentials were exposed across our systems. Within a single day of deployment, we gained complete visibility into our entire environment, and every alert was a real threat — not a single false positive."
Daeyoung Jeong
Security Team Leader
""As a startup CEO wearing multiple hats, I didn't have time to manually check for exposed credentials. Cremit found AWS keys I didn't even know were at risk and let me secure them before anything happened.""
Woongab Jeong
CEO, Founder
"As a solo security lead at a growing commerce company, I couldn't keep up with credential management across all our platforms. Cremit gave me the visibility and automation I needed to do my job effectively — without asking for more headcount."
Jihoon Gong
Compliance Security Engineer
"As we prepared for ISMS certification, Cremit helped us identify Google Cloud service keys we didn't even know were exposed. Securing these credentials not only reduced our risk but gave us the documented evidence we needed for the audit."
Jinseok Yeo
Security Engineer
"As media infrastructure moves to the cloud, credential management becomes exponentially more complex. Cremit gave us the visibility we needed to secure our GitLab environment and protect the cloud infrastructure that serves millions of viewers every day."
OOO
Security Manager
"Traditional vendors communicate via email or phone, but with Cremit we can quickly reach out through Slack Connect. Having a feature request implemented in just 15 minutes was truly impressive."
Jeongcheol Kang
Security Engineer
"Before Cremit, we had no way of knowing where or how many credentials were exposed across our systems. Within a single day of deployment, we gained complete visibility into our entire environment, and every alert was a real threat — not a single false positive."
Daeyoung Jeong
Security Team Leader
""As a startup CEO wearing multiple hats, I didn't have time to manually check for exposed credentials. Cremit found AWS keys I didn't even know were at risk and let me secure them before anything happened.""
Woongab Jeong
CEO, Founder
"As a solo security lead at a growing commerce company, I couldn't keep up with credential management across all our platforms. Cremit gave me the visibility and automation I needed to do my job effectively — without asking for more headcount."
Jihoon Gong
Compliance Security Engineer
"As we prepared for ISMS certification, Cremit helped us identify Google Cloud service keys we didn't even know were exposed. Securing these credentials not only reduced our risk but gave us the documented evidence we needed for the audit."
Jinseok Yeo
Security Engineer
"As media infrastructure moves to the cloud, credential management becomes exponentially more complex. Cremit gave us the visibility we needed to secure our GitLab environment and protect the cloud infrastructure that serves millions of viewers every day."
OOO
Security Manager
"Traditional vendors communicate via email or phone, but with Cremit we can quickly reach out through Slack Connect. Having a feature request implemented in just 15 minutes was truly impressive."
Jeongcheol Kang
Security Engineer
"Before Cremit, we had no way of knowing where or how many credentials were exposed across our systems. Within a single day of deployment, we gained complete visibility into our entire environment, and every alert was a real threat — not a single false positive."
Daeyoung Jeong
Security Team Leader
""As a startup CEO wearing multiple hats, I didn't have time to manually check for exposed credentials. Cremit found AWS keys I didn't even know were at risk and let me secure them before anything happened.""
Woongab Jeong
CEO, Founder
"As a solo security lead at a growing commerce company, I couldn't keep up with credential management across all our platforms. Cremit gave me the visibility and automation I needed to do my job effectively — without asking for more headcount."
Jihoon Gong
Compliance Security Engineer
"As we prepared for ISMS certification, Cremit helped us identify Google Cloud service keys we didn't even know were exposed. Securing these credentials not only reduced our risk but gave us the documented evidence we needed for the audit."
Jinseok Yeo
Security Engineer
"As media infrastructure moves to the cloud, credential management becomes exponentially more complex. Cremit gave us the visibility we needed to secure our GitLab environment and protect the cloud infrastructure that serves millions of viewers every day."
OOO
Security Manager
"Traditional vendors communicate via email or phone, but with Cremit we can quickly reach out through Slack Connect. Having a feature request implemented in just 15 minutes was truly impressive."
Jeongcheol Kang
Security Engineer
"Before Cremit, we had no way of knowing where or how many credentials were exposed across our systems. Within a single day of deployment, we gained complete visibility into our entire environment, and every alert was a real threat — not a single false positive."
Daeyoung Jeong
Security Team Leader
""As a startup CEO wearing multiple hats, I didn't have time to manually check for exposed credentials. Cremit found AWS keys I didn't even know were at risk and let me secure them before anything happened.""
Woongab Jeong
CEO, Founder
Built for every stage
Whether you're securing your first repository or running an enterprise NHI program, Cremit shows you which credentials are live, where they are, and who owns them.
Startups
Secure your infrastructure in days, not months.
- Simplest and most secure onboarding experience
- Rotation-age policies and live revocation checks
- 1:1 Slack support with security engineers
Mid-Market
Configurable workflows that automate incident triage and routing.
- Audit log and REST API for audit evidence
- Context-aware risk signals: live verification, public exposure, permission scope (AWS, GCP)
- 1,000+ detection rules and rotation-age policies
Enterprise
Automate detection, verification and triage so teams can focus on remediation.
- Automated incident workflows (notify, assign, prioritize)
- Dedicated technical account manager
- Custom integration development
From the blog
Latest from our research
Your Dashboard Says 14,000 Secrets. The Number That Matters Is 525.
Every secret scanner hands you a big number, and almost nobody can act on it. When we verified each finding against the service that issued it, a five-figure detection count became a three-figure inventory of credentials that actually work. This is what that collapse means for how you prioritize, what you suppress, and what you tell your board.
9 min readRead
From Research to Product: How Cremit Built Cremit Platform to Solve the NHI Security Gap
We spent six months documenting why non-human identity (NHI) security fails in real organizations, from bug bounties that call leaked keys "out of scope" to the nine-part NHI Kill Chain. Cremit Platform is the product we built from what that research proved.
8 min readRead
New research · September 2026
Blast Radius: a field playbook for leaked API keys
When a key leaks, most teams delete it first. That is the moment the evidence of where it reached disappears. Six phases for AWS, GCP and Azure, with a version-by-version diff of AWS's compromised-key quarantine policy.
FAQ
Frequently asked questions
Short answers to what people ask before starting on the free plan. The full list is on the FAQ page.
What is non-human identity (NHI) security?
NHI security is finding, verifying and controlling the credentials machines use to authenticate, such as API keys, service accounts, tokens and SSH keys. Because these identities usually have no owner, expiry or MFA, a leaked one can stay usable for months, so the work is to inventory them, detect exposure, confirm which exposed credentials still work, and rotate or revoke them.
What does Cremit detect?
Cremit detects exposed credentials: cloud access keys for AWS, GCP and Azure, API keys and OAuth tokens for third-party services, database connection strings, SSH private keys and similar secrets, in source code, git history, documents, chat messages, cloud storage, and the public pages of external assets you approve. It does not classify general sensitive data such as PII or business documents.
How does Cremit know whether a leaked key still works?
Each finding is checked against the service that issued the credential. A key that still authenticates is marked live and ranked first; one that has been revoked or has expired is recorded but not raised as an incident. This verification step is what removes most of the noise a pattern-only scanner produces.
Which sources can Cremit scan?
Scan sources are GitHub, GitLab, Bitbucket, GitHub Packages (GHCR images), AWS S3, Google Drive, Jira, Confluence, Notion and Slack (messages and attachments). AWS (via CloudFormation) and GCP (via a service account) are connected for permission analysis. Alerts are delivered to Slack, a webhook, Telegram or email, and the platform supports SAML 2.0 / OIDC SSO, SCIM 2.0 provisioning (e.g. Okta) and Google Workspace directory sync.
Does Cremit store my source code?
No. Files are read during a scan and are not retained. Cremit keeps each finding's location, secret type and verification status, plus the credential value itself encrypted with AWS KMS (optionally your own customer-managed key), because re-verification needs it.
How do I get started, and is there a free plan?
Sign up at argus.cremit.io on the free plan, no credit card, and connect your first source with a GitHub App, OAuth or a CloudFormation template. The first scan starts right away and any credential that is verified live goes to the top of the list. Paid and enterprise plans are available on request.
How many of your leaked keys
still work?
Connect your repos and clouds on the free plan. Cremit checks each exposed credential against the real provider and shows you the ones that still open something. No sales call needed.
Newsletter
Monthly NHI research brief
Security engineers and CISOs read our monthly brief on Non-Human Identity attacks, controls, and field research.