Mar 25, 2025
Wake-Up Call: tj-actions/changed-files Compromised NHIs
A GitHub Action used by more than 23,000 repositories was altered and its version tags retagged, leaking CI/CD secrets into build logs. The incident read as an NHI failure.
Ben Kim
Mar 18, 2025
How to find hidden credentials in code and shared tools
A practical workflow for preventing, finding, verifying, and replacing exposed credentials across code and shared tools.
Ben Kim
Mar 3, 2025
OWASP NHI1: Offboard machine access without breaking a service
When a service ends or its owner leaves, decide what still runs, transfer responsibility or revoke access, and verify the old key no longer works.
Ben Kim
Feb 25, 2025
AWS S3 secret scanning: what a connected bucket shows
Cremit reads supported current objects in connected S3 buckets to locate credentials. Check access, skipped objects, earlier versions and the issuer separately.
Ben Kim
Feb 25, 2025
Secret scanning: when to use built-in, open-source or connected-source checks
Start with the sources you need to inspect, the evidence each check returns, and who will revoke a live key. Compare GitHub, Gitleaks and Cremit by the work each covers.
Ben Kim
Feb 18, 2025
OWASP NHI2: Secret leakage and the four checks after discovery
A leaked secret is a lead, not proof of misuse. Check its location, validity, access, and response owner before closing the exposure.
Ben Kim
Feb 4, 2025
OWASP NHI3: reviewing access held by a third-party integration
A vendor can hold a token that reaches your SaaS data. Use the Salesloft Drift incident and GitHub App controls to review the grant, owner, activity and revocation path.
Ben Kim
Dec 5, 2024
Six checks for securing workload credentials
Before adding another key or vault entry, identify the workload, prefer temporary access, bound its permissions, plan exposure response and retire unused identities.
Ben Kim
Nov 17, 2024
Frontend API key leaks: classify and investigate browser output
A browser-visible key may be public by design or an active secret. Use issuer key types, a documented Resend case, and build evidence to decide.
Ben Kim
Nov 6, 2024
Cremit Joins AWS SaaS Spotlight Program
Cremit has joined the AWS SaaS Spotlight program for early-stage SaaS startups in Asia Pacific.
Ben Kim
Aug 3, 2024
Probe to Cremit Platform: what credential scanning does today
An updated guide to Cremit Platform’s scan sources, live credential checks, and remediation workflow, with current product limits.
Ben Kim
Apr 9, 2024
OWASP NHI Top 10: what to check for each machine identity risk
The ten OWASP NHI risks explained through specific checks for service accounts, tokens, deployment systems, and owners.
Ben Kim
Don't miss the next one
A short monthly brief on credential security from Cremit.