Jul 28, 2026
From exposed credentials to Cremit Platform: the workflow we support
How Cremit Platform finds exposed credentials, verifies supported types, and routes findings to an owner, with clear limits.
Ben Kim
Back to Blog
Tag
DevSecOps
15 posts
Jul 22, 2026
Secret scanning false positives: how to triage findings
A pattern match, a revoked key, and an unverified key need different responses. Learn how to separate them and prioritize exposed credentials.
Ben Kim
Apr 30, 2026
Eight credential exposure patterns and how to respond
A practical summary of eight NHI credential exposure patterns, the evidence to check, and what Cremit Platform can help investigate.
Ben Kim
Apr 29, 2026
AITU CTF Final 2026 Writeup
Full writeup of the AITU CTF Final (April 25-26, 2026), a HackCity-format competition. We walk through exploiting DMZ hosts via XXE, SSTI, and SQLi, pivoting into the DEV segment through AD lateral movement, escaping a privileged Docker container via cgroup abuse, and breaching a healthcare system through JWT JKU header injection.
Ethan Kim
Apr 20, 2026
When an exposed credential has no clear owner
How to verify, investigate, assign, and replace an exposed credential when the service owner is unclear.
Ben Kim
Apr 17, 2026
Same key in a repository and ticket: investigating cross-platform findings
Two source types show two observed locations, not how a credential moved. Check access, issuer status, owner, and actual consumers.
Ben Kim
Apr 14, 2026
Deleted file, active credential: investigating a Zombie Key
Source removal does not revoke a credential. Check the issuer, Git history, current owner, and last verification before closing the finding.
Ben Kim
Apr 11, 2026
One API key in three repositories: investigating shared credentials
Three observed locations are not a complete dependency map. Check key type, issuer status, permissions, and actual consumers before replacement.
Ben Kim
Apr 10, 2026
Long-exposed credentials: what a 90-day source record tells you
An old source record and an active key do not establish key age. Check when the value appeared, issuer status, permissions, and dependencies.
Ben Kim
Apr 5, 2026
API keys in incident chats and tickets: what to investigate
A credential outside a repository needs a source-access review, issuer check, owner, and verified response. A finding alone does not prove misuse.
Ben Kim
Apr 2, 2026
Orphaned API keys after offboarding: what the evidence shows
An active key linked to an inactive author is a lead. Check the directory, source, issuer, and current service owner before deciding what happened.
Ben Kim
Mar 25, 2026
When the Security Scanner Became the Weapon: A Cyber Kill Chain Analysis of the Trivy Supply Chain Attack
Aqua Security's Trivy was compromised by TeamPCP, cascading into LiteLLM. A 7-phase Cyber Kill Chain and MITRE ATT&CK analysis of how incomplete credential rotation turned a single breach into a five-ecosystem catastrophe.
Ben Kim
Jan 26, 2026
Git secret scanning in 2026: coverage, setup, and response
A practical guide to push protection, history scans, validity checks, and issuer-side response, with GitHub, GitLab, and Gitleaks source links.
Ben Kim
Apr 14, 2025
Secret scanning before and after a Git push
A key caught before push can be removed from the change. A key found afterward needs issuer-side revocation or rotation, even if the commit is deleted.
Ben Kim
Mar 18, 2024
DevSecOps starts with a credential your team can actually fix
A practical rollout for credential detection across repositories and collaboration tools, with clear owners and honest scan timing.
Ben Kim