Jul 22, 2026
Secret scanning false positives: how to triage findings
A pattern match, a revoked key, and an unverified key need different responses. Learn how to separate them and prioritize exposed credentials.
Ben Kim
Back to Blog
Category
Technical Guides
Best practices and technical tutorials
11 posts
Jun 13, 2026
Your Slack Webhook Is Write-Only, Until an AI Agent Reads the Channel
A leaked Slack incoming webhook is usually triaged as low severity: write-only, one channel, no data access. The moment an AI agent reads that channel and can act with tools, that write-only primitive becomes an indirect prompt injection path into the agent's privileges. Here is the full kill chain, the exact preconditions, and how to defend it.
Ben Kim
Apr 23, 2025
A rotation record is not a map of leaked credentials
Lifecycle records show intended access. Secret findings show copies in scanned sources. Compare both before deciding who should replace a key.
Ben Kim
Apr 18, 2025
Where credentials escape a CI/CD pipeline
A key can land in Git history, build output or a published image. Use a different check at each boundary and verify any exposure at its issuer.
Ben Kim
Apr 14, 2025
Secret scanning before and after a Git push
A key caught before push can be removed from the change. A key found afterward needs issuer-side revocation or rotation, even if the commit is deleted.
Ben Kim
Apr 14, 2025
A credential in an S3 object: what to check next
A key-shaped string in S3 does not prove public access, a live credential, or misuse. Check the object, issuer, scan coverage, and earlier versions.
Ben Kim
Apr 4, 2025
Data breach costs: what an exposed key finding can tell you
A breach-cost average cannot price one exposed credential. Record the key’s source, issuer status, available access and activity evidence, and response work before estimating impact.
Ben Kim
Feb 25, 2025
AWS S3 secret scanning: what a connected bucket shows
Cremit reads supported current objects in connected S3 buckets to locate credentials. Check access, skipped objects, earlier versions and the issuer separately.
Ben Kim
Feb 25, 2025
Secret scanning: when to use built-in, open-source or connected-source checks
Start with the sources you need to inspect, the evidence each check returns, and who will revoke a live key. Compare GitHub, Gitleaks and Cremit by the work each covers.
Ben Kim
Aug 3, 2024
Probe to Cremit Platform: what credential scanning does today
An updated guide to Cremit Platform’s scan sources, live credential checks, and remediation workflow, with current product limits.
Ben Kim
Feb 26, 2024
What is secret detection? From pattern match to response
Secret detection finds possible credentials in content a tool actually inspects. Learn what a match proves, where scans run, and how to verify and contain an exposed key.
Ben Kim