Find exposed keys and tokens across code, cloud and chat. Check supported types with the issuer and see who should respond.
2 GB of scanning free every month. No card required.
Our research team takes public incidents apart to find the keys and tokens involved, and what a team should rotate first.
An exposed key is a lead. Connect it to its issuer, principal, permissions, workload, and owner before closing the access path.
From Cremit research. Each figure links to the study and its method.
23,912
active credentials confirmed on 33 public surfaces
Live credentials study · Sep 2026
1,277
of the keys we could grade had permission to issue another key
Live credentials study · Sep 2026
71.3%
of 22,027 remote MCP servers opened a session with no header authentication
MCP tool arguments study · Oct 2026
3,705
credential fields declared in MCP tool arguments
MCP tool arguments study · Oct 2026
The real product, shown here with a fictional sample organization. Pick a step.
01Find
The checklist sorts valid secrets by exposure pattern: outside source code, exposed for months, copied across tools, deleted but still valid, or public.
02Trace
Each credential keeps its locations, history and owner signals on one graph, so you know the full spread before anyone revokes it.
03Scope
Register AWS and GCP analyzers once. Each supported key then gets a permission review next to its finding, so the most dangerous key is handled first.
04Respond
Open an incident from a finding, assign a responder and follow it to resolution. Alerts go to Slack, a webhook, Telegram or email.
05Vault
Connect your secret manager to see each stored secret with its provider path, current version and whether the same value also sits in code.
06ShareComing soon
Team sharing is coming to Cremit: API keys and tokens shared within the right scope, with access permissions and usage history, on the same inventory and owners shown here.
The product screen appears here when team sharing ships. Ask us about early access in a demo.
Every screen on this page is the shipped interface with sample data.
Click through it yourselfOrders export access
AKIA••••••••K7Q2
Vaulted
Stored in your secret manager
Cremit does not rotate or revoke credentials for you. It gives the right person the evidence to act at the issuer, then rechecks supported keys so you can confirm the old one stopped working.
1,000+ rules across 10 source types.
Supported types are checked with the issuer. The rest go to review.
AWS and GCP keys mapped to what they can reach.
Author candidates and directory accounts point to an owner.
Supported live keys rechecked about every 6 hours.
From a key found in code to a credential used by your team. Cremit’s platform design connects the credential lifecycle. Talk to us about the right setup for your team.
01 / Discover
Find exposed credentials across connected code, cloud storage and collaboration tools. Check validity for supported types and track owner response.
Credential inventory · Exposure detection · Validity checks · Response tracking
See the response flow02 / Store
A path from discovered credentials to managed credentials. The storage layer is designed around native Vault storage and existing vault integrations.
Native storage · Existing vault integrations · Credential migration
Review Vault storage03 / Share
API keys and tokens for the people who need them, within the right scope. A shared workspace designed to connect team sharing, access permissions and usage history.
Team sharing · Access permissions · Usage history
Explore team sharing04 / Use
An access model that extends to developer tools and AI agents. The platform direction brings common credential controls to CLI, desktop and agent workflows.
CLI · Desktop · Agent access
Discuss your developer tools
What changed after they connected their sources, in their words.
Next Securities“Traditional vendors communicate via email or phone, but with Cremit we can quickly reach out through Slack Connect. Having a feature request implemented in just 15 minutes was truly impressive.”
Rapportlabs“As a solo security lead at a growing commerce company, I couldn't keep up with credential management across all our platforms. Cremit gave me the visibility and automation I needed to do my job effectively — without asking for more headcount.”
8Percent“Before Cremit, we had no way of knowing where or how many credentials were exposed across our systems. Within a single day of deployment, we gained complete visibility into our entire environment, and every alert was a real threat — not a single false positive.”
ENlighten“As we prepared for ISMS certification, Cremit helped us identify Google Cloud service keys we didn't even know were exposed. Securing these credentials not only reduced our risk but gave us the documented evidence we needed for the audit.”
SBSi“As media infrastructure moves to the cloud, credential management becomes exponentially more complex. Cremit gave us the visibility we needed to secure our GitLab environment and protect the cloud infrastructure that serves millions of viewers every day.”
Ordercheck“As a startup CEO wearing multiple hats, I didn't have time to manually check for exposed credentials. Cremit found AWS keys I didn't even know were at risk and let me secure them before anything happened.”
Count observed locations, distinct credential records and verification states separately. Define scope and check time before reporting exposure.
How Cremit Platform finds exposed credentials, verifies supported types, and routes findings to an owner, with clear limits.
A pattern match, a revoked key, and an unverified key need different responses. Learn how to separate them and prioritize exposed credentials.
New research · September 2026 · Free PDF · English & Korean · No form
Record where the key was exposed and preserve available logs without delaying containment. The six-phase AWS, GCP and Azure guide also compares versions of AWS's compromised-key quarantine policy.
Sources, alert channels, identity and cloud analysis available today.
GitHub
GitLab
Bitbucket
Google Drive
Jira
Confluence
Notion
SlackSlack
Telegram
Okta SCIM
Google Workspace
Google CloudRegister a domain or GitHub organization. Cremit proposes related public assets with evidence and can monitor them for exposed keys.
External scanningCremit runs an ISO/IEC 27001 certified information security program, because the data we hold is the most sensitive data you have.
Detected credential values are encrypted with AWS KMS. You can bring your own customer-managed key.
Source content is read during a scan, never kept as whole files afterwards.
Each connection asks only for the access its scan needs, listed in its setup guide. Cremit does not rotate or revoke your keys.
Evidence for your own audits
Cremit holds ISO/IEC 27001 certification.
Walk through your environment with a security engineer.
Book a demoConnect a source on the free plan. 2 GB a month, no card.
Start freeClick through the real product with sample data. No sign-up.
Take the product tourSee findings from your own environment on the free plan. Compare monthly pricing and included scan volume before you commit.
Choose a source and review its access scope and setup instructions.
Integration guidesCremit does not retain entire scanned source files. Detected credentials are stored encrypted using AWS KMS.
How data is handledDisconnecting a source and deleting existing records are separate steps. Review retention and deletion by data type.
Retention and deletionCheck what a finding proves, what Cremit stores, and who takes action.
See all questionsNo. Cremit checks validity with the issuing service for supported credential types. Other findings need manual review. A successful check says the key authenticated at that time; it does not prove someone misused it.
It scans sources you connect, including GitHub, GitLab, Bitbucket, GHCR images, AWS S3, Google Drive, Jira, Confluence, Notion and Slack. External scanning can check bounded public content when enabled for your organization. It cannot inspect a local file or an unconnected service.
Cremit can show access context for supported AWS access keys and GCP API keys. That context depends on the available analysis; a validity result alone does not show every permission or prove the key was used. Check issuer records and activity logs before judging impact.
The service owner does that at the issuer. Cremit records where a key was found, its available verification result and the response status. An assigned owner, a suggested candidate and a source-file author are different signals; the team confirms who should act. Cremit does not rotate or revoke keys automatically.
Cremit reads source content during a scan but does not retain whole source files. It stores finding metadata and the credential value encrypted with AWS KMS for supported re-verification. A customer-managed KMS key can be configured.
Yes. The free plan at argus.cremit.io does not require a credit card. Connect a supported source and review its findings before choosing a paid plan.
No. A match still needs review; it does not prove the key works. Cremit checks validity with the issuer for supported credential types, and other findings stay marked for manual review.
Supported keys last confirmed active are rechecked about every 6 hours. Types without a verifier are not rechecked automatically.
The interface is the actual Cremit product. The records belong to a fictional sample organization, so counts, statuses and owner assignments are illustrative values, not customer results.
It proposes public assets related to a registered domain or GitHub organization, with the evidence for each. Content secret checks are separately enabled and bounded; review what was actually scanned for each target.
A non-human identity is a service account, workload principal or other software actor authenticated with a key, token, certificate or delegated grant. Securing it means knowing who controls it, what it can access and how to retire that access. A credential found outside its approved store is one signal to investigate.
Non-human identity: examples and security practicesCremit Platform scans connected repositories, cloud storage and collaboration tools for exposed credentials. It checks current validity for supported types and adds available access context for supported AWS access keys and GCP API keys. A finding keeps its source location and ownership signals so a person can confirm who should respond at the issuer.
Security engineers and CISOs read our monthly brief on Non-Human Identity attacks, controls, and field research.
Optional cookies count visits, identify visiting companies, and measure ads. You can decline. Cookie policy
