Cremit at a glance

Cremit finds secrets left in code repositories, collaboration tools and cloud storage, and checks whether each one can still be used. You then give each secret an owner and clean it up by rotating or revoking the key. Every step is recorded in your organization's activity history.

How secrets get cleaned up

Step	What happens	Menu
1. Connect sources	Connect the repositories and tools where Cremit should look for secrets.	Integrations › Scan Sources
2. Find	Cremit scans what you connected and collects the secrets it finds in one list.	Inventory › All
3. Verify	Cremit checks whether each secret is still valid. Valid secrets that have not been handled yet are gathered separately.	Inventory › Needs action
4. Assign owners	Decide who is responsible for each secret.	People and owners › Owners
5. Remediate	Rotate or revoke the exposed key and store the new value in a vault.	To do › Remediation cases, Vault
6. Audit	See who did what in your organization.	Audit and reports › Audit Logs

Verification results appear as statuses such as Valid, Revoked and Needs manual review. Verification status explains each one.

Other menus

• Dashboard: an overview of the whole organization. See Reading the dashboard.
• External exposure: internet-facing assets such as domains and URLs.
• Policies: Detection Rules.
• Settings: organization details and sharing policy, members and billing.

The menus you see depend on your role and on the features enabled for your organization. The full layout is in How the menu is organized.

If you are just starting

1. Sign up and create an organization
2. Connect your first scan source
3. Choose roles for your colleagues in Roles and permissions