Cremit finds exposed keys and tokens in connected repositories, cloud storage and collaboration tools. It checks supported types with their issuer and brings ownership information into the same view.
2 GB of scanning free every month. No card required.
Our research team takes public incidents apart to find the keys and tokens involved, and what a team should rotate first.
An attacker accessed the internal systems of PingCAP, the company behind TiDB, from September 9 to October 7. The attacker used a stolen GitHub account to find cloud keys and a Jira token in code, then used AWS keys customers had shared in support tickets to reach S3 buckets holding their diagnostic data. We separate confirmed facts from the attacker's claims and list what users and other teams should do.
From Cremit research. Each figure links to the study and its method.
23,912
valid secrets confirmed on 33 public surfaces
Live credentials study · Sep 2026
1,277
of the keys we could grade had permission to issue another key
Live credentials study · Sep 2026
71.3%
of 22,027 remote MCP servers opened a session with no header authentication
MCP tool arguments study · Oct 2026
3,705
secret fields declared in MCP tool arguments
MCP tool arguments study · Oct 2026
The real product, shown here with a fictional sample organization. Pick a step.
01Find
The checklist sorts valid secrets by exposure pattern: outside source code, exposed for months, copied across tools, deleted but still valid, or public.
02Trace
Review recorded locations, history and ownership together in a graph. Investigate copies and arrange prompt containment of exposed keys at their issuer.
03Scope
Connect AWS and GCP analyzers to review available permission context for supported keys. Use it with exposure locations and validity to decide priority.
04Respond
Open an incident from a finding, assign a responder and follow it to resolution. Alerts go to Slack, a webhook, Telegram or email.
05Vault
Keep values in Cremit Vault by project and environment. Connect AWS Secrets Manager, Parameter Store or HashiCorp Vault read-only to see each stored secret with its provider path, current version and whether the same value also sits in code.
06Share
Share secret records with people or teams at View or Manage. Grant access to values in Cremit Vault, set an approver and expiry, or send a one-time link to an organization member.
Every screen on this page is the shipped interface with sample data.
Click through it yourselfOrders export access
AKIA••••••••K7Q2
Vaulted
Stored in your secret manager
Cremit hands the right person the evidence to act. For AWS IAM user keys kept in AWS Secrets Manager, it issues the new key, stores it and retires the old one, with an organization owner or admin approving each step. For other keys it shows the rotation steps, then rechecks supported keys so you can confirm the old one stopped working.
1,000+ rules across 10 source types.
Supported types are checked with the issuer. The rest go to review.
Analyze available permissions for supported AWS and GCP keys.
Review owner candidates from authors and matched directory accounts.
Supported valid keys rechecked about every 6 hours.
Find exposed secrets and check supported types for validity. Store secrets in Cremit Vault and share with people or teams. The CLI injects approved values into a process; AI agents use MCP to read findings and request access.
01 / Discover
Find exposed secrets in connected code, cloud storage and collaboration tools. Check supported types with the issuer, see the blast radius of AWS and GCP keys, and track each fix in a remediation case.
Inventory · Validity checks · Blast radius · Remediation cases
See the response flow02 / Store
Store values by project and environment, encrypted with AES-256-GCM using data keys protected by AWS KMS. Reading a value requires an access request and passkey approval. Connect existing AWS Secrets Manager, Parameter Store and HashiCorp Vault instances read-only.
Cremit Vault · Passkey approval · Connected vaults
See storage and connected vaults03 / Share
Share a secret with specific people or teams: its record at View or Manage, or its value in Cremit Vault. Each share can have an approver and an expiry date, and one-time links reach organization members only. Shares and link reads go to the audit log.
People and teams · Approvals · Expiry · One-time links
See team sharing04 / Use
The Cremit CLI uploads local and CI scan results and injects approved Vault values into a process. AI agents use MCP to read findings and secret metadata or file access requests. No MCP tool returns a secret value.
Cremit CLI · MCP server · Access requests
Set up CLI and agent access
What changed after they connected their sources, in their words.
Next Securities“Traditional vendors communicate via email or phone, but with Cremit we can quickly reach out through Slack Connect. Having a feature request implemented in just 15 minutes was truly impressive.”
Rapportlabs“As a solo security lead at a growing commerce company, I couldn't keep up with credential management across all our platforms. Cremit gave me the visibility and automation I needed to do my job effectively — without asking for more headcount.”
8Percent“Before Cremit, we had no way of knowing where or how many credentials were exposed across our systems. Within a single day of deployment, we gained complete visibility into our entire environment, and every alert was a real threat — not a single false positive.”
ENlighten“As we prepared for ISMS certification, Cremit helped us identify Google Cloud service keys we didn't even know were exposed. Securing these credentials not only reduced our risk but gave us the documented evidence we needed for the audit.”
SBSi“As media infrastructure moves to the cloud, credential management becomes exponentially more complex. Cremit gave us the visibility we needed to secure our GitLab environment and protect the cloud infrastructure that serves millions of viewers every day.”
Ordercheck“As a startup CEO wearing multiple hats, I didn't have time to manually check for exposed credentials. Cremit found AWS keys I didn't even know were at risk and let me secure them before anything happened.”
An attacker accessed the internal systems of PingCAP, the company behind TiDB, from September 9 to October 7. The attacker used a stolen GitHub account to find cloud keys and a Jira token in code, then used AWS keys customers had shared in support tickets to reach S3 buckets holding their diagnostic data. We separate confirmed facts from the attacker's claims and list what users and other teams should do.
On October 21, LiteLLM's own release pipeline published a credential-stealing 1.107.0 to PyPI and Docker. It started with an admin key committed to a public repository on May 27, deleted three hours later and never revoked. The attack path, what the build collected, what users should do, and what every team should check.
Zeabur, a Taiwanese PaaS, is shutting down on December 31 after two breaches in two months. The October attacker used plaintext admin tokens and AWS keys that were never rotated after August to reach shared clusters in nine regions and the platform database. We separate what is confirmed from what is still a hypothesis, list what users should do, and turn the root causes into a checklist for other teams.
New research · September 2026 · Free PDF · English & Korean · No form
Record where the key was exposed and preserve available logs without delaying containment. The six-phase AWS, GCP and Azure guide also compares versions of AWS's compromised-key quarantine policy.
Sources, alert channels, identity and cloud analysis available today.
GitHub
GitLab
Bitbucket
Google Drive
Jira
Confluence
Notion
SlackSlack
Telegram
Okta SCIM
Google Workspace
Google CloudRegister a domain or GitHub organization to discover related public assets and their supporting evidence. Monitor supported assets and scan public content within configured limits. Available on the Enterprise plan.
External scanningCremit holds ISO/IEC 27001 certification. Review how detected secret values are encrypted, how source files are handled and which permissions each integration uses.
Detected secret values are encrypted with AWS KMS. You can bring your own customer-managed key.
Source content is read during a scan, never kept as whole files afterwards.
Each connection asks only for the access its scan needs, listed in its setup guide. Rotating AWS keys uses a separate write role that you add only if you want Cremit to do it.
Evidence for your own audits
Cremit holds ISO/IEC 27001 certification.
Walk through your environment with a security engineer.
Book a demoConnect a source on the free plan. 2 GB a month, no card.
Start freeClick through the real product with sample data. No sign-up.
Take the product tourSee findings from your own environment on the free plan. Compare monthly pricing and included scan volume before you commit.
Choose a source and review its access scope and setup instructions.
Integration guidesCremit does not retain entire scanned source files. Detected secrets are stored encrypted using AWS KMS.
How data is handledDisconnecting a source and deleting existing records are separate steps. Review retention and deletion by data type.
Retention and deletionCheck what a finding proves, what Cremit stores, and who takes action.
See all questionsCremit automatically checks validity with the issuer only for supported secret types. Other findings remain Needs manual review. A successful check shows the key authenticated at that time; it does not prove misuse.
Cremit scans connected GitHub, GitLab, Bitbucket, GitHub Packages, AWS S3, Google Drive, Jira, Confluence, Notion and Slack sources. The Cremit CLI scans local files, Git history or CI diffs and uploads results. External scanning checks public content within configured limits.
Cremit shows permission context for supported AWS and GCP keys when an analyzer is connected. AWS analysis includes IAM policies, role paths, privilege escalation paths matched from policies, chained secrets and choke points. GCP analysis covers API key restrictions and service-account key project roles and impersonation permissions. Check issuer logs for actual use.
Cremit rotates AWS IAM user keys stored in AWS Secrets Manager with step-by-step approval; owners rotate other keys at their issuer. AWS rotation requires a separate writer role and approval from an organization owner or admin. For other keys, guided steps and remediation cases track the fix; the case closes on a Revoked recheck of the old key and a new vault version.
Cremit reads source content during scans but does not retain whole source files. It stores finding metadata and encrypts secret values for supported re-verification. A customer-managed KMS key can protect detected secret values.
You can start Cremit on the free plan without a sales call or credit card. Connect a supported source at argus.cremit.io and review its findings.
A Cremit detection-rule match does not prove the key works. Cremit checks supported types with the issuer and marks other findings Needs manual review.
Cremit rechecks supported keys last marked Valid about every 6 hours. Types without a verifier are not rechecked automatically.
The interface is the actual Cremit product. The records belong to a fictional sample organization, so counts, statuses and owner assignments are illustrative values, not customer results.
Cremit External Scanning discovers public assets related to registered assets and monitors supported targets. A domain or GitHub organization can start discovery. Content secret checks require separate settings and have coverage limits.
Non-human identity (NHI) security manages access for service accounts, workload principals and other software actors. They authenticate with keys, tokens, certificates or delegated grants. Review who controls each identity, what it can access and how that access ends.
Non-human identity: examples and security practicesCremit is an NHI security platform for finding and managing secrets. It scans connected repositories, cloud storage and collaboration tools, checks supported types for validity and shows available blast-radius analysis for AWS and GCP keys. Review locations and ownership, and store and share values in Cremit Vault.
A monthly brief on NHI attacks, controls and field research.
Optional cookies count visits, identify visiting companies, and measure ads. You can decline. Cookie policy
