Find your external assets —
and the credentials exposed on them.
Register a domain or GitHub organization, and Cremit automatically identifies connected external assets. Only approved assets are scanned, with detected credentials surfacing directly in Findings and Inventory. Manage both internal and external risks in a single view.
How many of your keys are already exposed to the public?
Secret Scanning looks inside the sources you connect. A personal public repo, a shipped frontend bundle, a package on an app store are company assets with nothing to connect. External Scanning takes a domain or a GitHub organization as a seed, identifies those assets, and detects credential exposure on the ones you approve.
What is External Scanning?
External scanning identifies the assets a company exposes on the internet and checks whether company credentials are public on them. Secret Scanning looks inside the sources you connect; external scanning looks only at the surface that is already public, with no access granted.
Start with a single domain. Approve only what is yours.
Cremit starts from one seed and identifies the assets connected to it. Each one arrives with the evidence for why it is attributed to you, and nothing is scanned before you approve it. A rejected asset does not come back.
- Domain
- Website
- API endpoint
- IP address
- iOS app
- Android app
- GitHub organization
How are external assets discovered?
- Subdomains named in public certificates
- Addresses DNS resolves to
- TLS certificates and their alternative names
- API endpoints a site links to
- Mobile apps named in well-known association files
- Public commits authored from a company email address
- Candidate · waiting on you
- Likely · strong evidence, approval still required
- Monitored · approved, on a schedule
- Rejected · out of scope
- MonitoredDomainexample.comConfidence 100%
- MonitoredWebsitewww.example.comConfidence 95%
- MonitoredAPIapi.example.com/v1Confidence 90%
- LikelyIP address203.0.113.10Confidence 70%Approve & monitorReject
- CandidateAndroid appcom.example.appConfidence 75%Approve & monitorReject
- LikelyGitHub organizationexample-orgConfidence 80%Approve & monitorReject
Unified Identity Posture Management on one screen
Credentials found outside land in the same inventory as the ones found inside. Internal and external exposure sit in one view, and ownership, incidents and workflows run the same way for both. There is no second console to open and no report to reconcile.
- Findings
- Inventory
- Inventory Graph
- Incidents
- Workflows
Scope and Limitations
Limitation
A completed scan indicates that the defined document set was read. It is not proof that a site holds zero secrets. Dynamically imported module graphs and source maps lie outside this bounded set.
Reachability checks and content scanning are separate switches. Turning on monitoring does not download anything.
Reachability Checks
Headers only. Whether the asset is alive and what it answers with.
Content Secret Scanning
Reads a bounded set of HTML, JavaScript and JSON and applies the same 1,000+ detection rules as an internal scan. Detected keys are checked against the issuing service and re-verified every 10 minutes after that.
What it does not do
- Cremit sends unauthenticated GET requests to pages that are already public. It does not sign in, submit forms or exercise vulnerabilities.
- Requests resolve to public addresses only, through a pinned resolver. Private and internal ranges are refused before a connection is opened.
- Cremit reports. It does not rotate, revoke or delete anything on your behalf.
- What is stored about an exposure is its status, the origin it was seen at (scheme, host and port), the media type and the timestamps. The full locator is never decrypted into the product.
Detect external exposure before attackers do.
Bring a domain and a GitHub organization and you can see your external exposure.
Frequently asked
Does Cremit scan domains we do not own?
No. Discovery starts from the seeds you register, and nothing is scanned before you approve it. Every proposed asset carries the evidence for why, and a rejected asset stays rejected.
Is this an attack simulation or a penetration test?
No. Cremit sends unauthenticated GET requests to pages that are already public, under a timeout, a size ceiling, a redirect ceiling and a per-host rate limit. It does not sign in, submit forms, exercise vulnerabilities or scan ports.
What does Cremit store about an exposure?
The status, the origin it was seen at as scheme, host and port, the media type, and the timestamps. Cremit never decrypts the full locator into the product.
Do we have to prove domain ownership before anything runs?
No. Verification is a trust badge, and monitoring runs without it. An organization holding tens of thousands of domains can start without planting a TXT record on any of them.
If a scan finishes clean, is the site clean?
It means the bounded document set was read and nothing was detected in it, not that the site holds no secrets. Imported module graphs and source maps sit outside that set.