Learn from experts, understand everything you need to know about compliance, and find answers to your pressing security questions.
We use cookies to measure traffic and ad performance. Declining costs you nothing: the site keeps working, and all that stays is your language and this answer. Everything we load is listed in the cookie policy
S3 buckets accumulate the machine roles, automated services and API keys that read and write to them. Cremit now scans those buckets continuously with read-only access and returns the inventory.
Building secret detection or buying it. The factors that actually decide it, one at a time.
Bybit lost 401,347 ETH, about $1.4 billion, on February 21. How the attack worked, and what it changes for exchange security.
OWASP NHI2:2025 covers API keys and tokens ending up in stores that were never meant to hold them. Where they leak, and how to stop it.
Third-party integrations reach into your resources with credentials you never issued. What OWASP NHI3:2025 covers, and where the exposure sits.
Six practices for keeping credentials out of reach: vaulting, least privilege, rotation and the rest.
Vigilant Ally is Cremit’s initiative to help developers find and close the secrets they have exposed on GitHub.
JavaScript bundles and source maps routinely leak API keys that never should have reached the browser. Here is how the leak happens, how to find it, and how to stop it.
Cremit has joined the AWS SaaS Spotlight program for early-stage SaaS startups in Asia Pacific.
Regex-based scanners miss credential formats nobody told them about. What Probe, Cremit’s detection engine, does differently.
OWASP NHI Top 10 names the machine-credential risks most teams still do not track. Here is what each threat means, and how each maps to real controls you can deploy.
DevSecOps puts security into every stage from commit to deploy. Why secret detection is a practical place to start.
Short monthly brief from the Cremit research team.