Jul 19, 2026
AI agent credentials: trace the tool, issuer and responder
An agent workflow may cross several identity boundaries. Trace the actual grant, source location, permissions and owner before judging a leaked key.
Ben Kim
Back to Blog
Tag
Cloud Security
14 posts
Apr 30, 2026
Eight credential exposure patterns and how to respond
A practical summary of eight NHI credential exposure patterns, the evidence to check, and what Cremit Platform can help investigate.
Ben Kim
Apr 20, 2026
When an exposed credential has no clear owner
How to verify, investigate, assign, and replace an exposed credential when the service owner is unclear.
Ben Kim
Apr 17, 2026
Same key in a repository and ticket: investigating cross-platform findings
Two source types show two observed locations, not how a credential moved. Check access, issuer status, owner, and actual consumers.
Ben Kim
Apr 11, 2026
One API key in three repositories: investigating shared credentials
Three observed locations are not a complete dependency map. Check key type, issuer status, permissions, and actual consumers before replacement.
Ben Kim
Apr 10, 2026
Long-exposed credentials: what a 90-day source record tells you
An old source record and an active key do not establish key age. Check when the value appeared, issuer status, permissions, and dependencies.
Ben Kim
Apr 5, 2026
API keys in incident chats and tickets: what to investigate
A credential outside a repository needs a source-access review, issuer check, owner, and verified response. A finding alone does not prove misuse.
Ben Kim
Apr 2, 2026
Orphaned API keys after offboarding: what the evidence shows
An active key linked to an inactive author is a lead. Check the directory, source, issuer, and current service owner before deciding what happened.
Ben Kim
Mar 25, 2026
When the Security Scanner Became the Weapon: A Cyber Kill Chain Analysis of the Trivy Supply Chain Attack
Aqua Security's Trivy was compromised by TeamPCP, cascading into LiteLLM. A 7-phase Cyber Kill Chain and MITRE ATT&CK analysis of how incomplete credential rotation turned a single breach into a five-ecosystem catastrophe.
Ben Kim
Mar 7, 2026
Clinejection: prompt injection and the unauthorized Cline CLI release
Cline’s issue-triage agent exposed a path to publishing credentials. A later unauthorized CLI release installed OpenClaw; Cline found no user data theft.
Ben Kim
Apr 27, 2025
Vercel secret exposure: check your Next.js browser bundle
Find where Next.js puts environment values in client output, distinguish public and secret Stripe keys, and replace a key exposed in a deployment.
Ben Kim
Apr 14, 2025
A credential in an S3 object: what to check next
A key-shaped string in S3 does not prove public access, a live credential, or misuse. Check the object, issuer, scan coverage, and earlier versions.
Ben Kim
Feb 25, 2025
AWS S3 secret scanning: what a connected bucket shows
Cremit reads supported current objects in connected S3 buckets to locate credentials. Check access, skipped objects, earlier versions and the issuer separately.
Ben Kim
Nov 6, 2024
Cremit Joins AWS SaaS Spotlight Program
Cremit has joined the AWS SaaS Spotlight program for early-stage SaaS startups in Asia Pacific.
Ben Kim