About Cremit
Cremit builds tools to investigate exposed keys.
Find where a credential surfaced, check supported types for validity, review access context for AWS access keys or GCP API keys, and identify who can act.
Founded in
Seoul, 2023
Seed · Primer · Strong Ventures
Why this work matters
Finding a credential is only the beginning. A response needs its location, whether it still works, what access is associated with it, and someone who can replace or revoke it.
Cremit brings those clues together in a finding so a security team can decide what to investigate and hand off next.
Vision and mission
A world where every identity works without plaintext keys.
People, servers, AI agents — every identity that does work needs keys. In the world we want, no identity holds a key directly. Each gets exactly what it needs, when it needs it, and every access is recorded.
Mission
Find every key behind every identity, and own it until it is used safely.
In the product
The checks behind each finding
Keep the source attached
Show where a credential was found in a connected repository, storage location, document, or message.
Verify only what can be checked
Check supported credential types with their issuer. Mark other findings for manual review instead of calling them active.
Give the response an owner
Show available access context for AWS access keys and GCP API keys, then route the finding to a person. The customer rotates or revokes the key.
How we work
Our values
Practice what we secure
No secrets in code, MFA on every account, least privilege. We scan ourselves with our own product first.
Start from the customer
Every feature starts with a real customer problem. Engineers talk to customers directly.
Ship small, ship often
Ship the smallest useful thing first, then learn from customers and iterate.
Write it down, in the open
We write down decisions and why. We don't hide what we can't do or don't know.
Own the outcome
Shipping is not the finish line. We check that customers actually use it and that it runs well.