# Cremit

> Cremit builds NHI (Non-Human Identity) security tooling. Argus is the product — it scans code repositories, document stores, messaging platforms, cloud storage, and cloud IAM to detect exposed credentials, API keys, and tokens, and helps teams rotate them before they are exploited.

Cremit is based in Seoul, founded in 2023. The blog covers secret sprawl, credential lifecycle, non-human identity failure patterns (the NHI Kill Chain series), and real security incidents analyzed from an NHI perspective.

## Product

- [Argus product](https://www.cremit.io/product) — the full platform overview
- [Identity Inventory](https://www.cremit.io/product/inventory) — discover machine identities across your infrastructure
- [Secret Scanning](https://www.cremit.io/product/scanning) — detect exposed credentials in code and data stores
- [Lifecycle Automation](https://www.cremit.io/product/automation) — automate rotation and revocation
- [Threat Detection](https://www.cremit.io/product/threats) — real-time anomaly detection on NHI usage
- [Offboarding Automation](https://www.cremit.io/product/offboarding) — auto-revoke machine identities tied to departed users
- Try the product: https://argus.cremit.io

## Integrations (16 supported)

Scan sources: https://www.cremit.io/integrations#scan_source
- GitHub, GitLab, AWS S3, Google Drive, Jira, Confluence, Notion, Slack

Permission analysis: https://www.cremit.io/integrations#permission_analysis
- AWS (via CloudFormation), GCP (via service account)

Alarm channels: https://www.cremit.io/integrations#alarm_channel
- Slack (OAuth), generic webhook, Telegram

SSO: https://www.cremit.io/integrations#sso
- SAML 2.0 (Okta, Azure AD, Google Workspace, Ping, JumpCloud, and any SAML 2.0 IdP)

SCIM / directory sync: https://www.cremit.io/integrations#scim
- Okta, Google Workspace

Full catalog: https://www.cremit.io/integrations

## Research & writing

Most-referenced pieces:

- [NHI Kill Chain series](https://www.cremit.io/blog/series/nhi-kill-chain) — a multi-part breakdown of recurring machine-credential failure patterns (Ghost, Shadow, Aged, Over-shared, Zombie, Drifted, Over-privileged, Public, Unattributed)
- [Vercel April 2026 Incident Is a Textbook NHI Problem](https://www.cremit.io/blog/vercel-april-2026-incident-nhi-secret-sprawl) — incident analysis: what to rotate and why
- [Clinejection: AI Supply Chain Attack Anatomy](https://www.cremit.io/blog/ai-supply-chain-attack-clinejection) — how a single GitHub issue compromised thousands of Cline installs
- [MoltBot: Your API Keys Are Exposed on the Internet](https://www.cremit.io/blog/viral-ai-assistant-moltbot-your-api-keys-are-exposed) — viral AI assistant exposing user credentials at scale
- [Out of Scope Loophole](https://www.cremit.io/blog/out-of-scope-loophole-credential-exposure) — why bug bounty programs miss credential exposure
- [Vercel Environment Variables Best Practices](https://www.cremit.io/blog/vercel-secret-exposure-case-study) — the April 2025 piece on developer-layer leaks
- [OWASP NHI Top 10 Explained](https://www.cremit.io/blog/understanding-the-owasp-non-human-identities-nhi-top-10-threats) — mapping each threat to operational controls
- [Frontend API Key Leaks](https://www.cremit.io/blog/credential-leakage-risks-hiding-in-frontend-code) — JavaScript bundles and source maps
- [Bitwarden CLI Supply Chain Attack (April 2026)](https://www.cremit.io/blog/bitwarden-cli-supply-chain-attack-april-2026) — 90-minute npm window analysis from an NHI angle

Reports:
- [RSAC 2026: NHI Platform Comparison (Astrix, Oasis, Entro, Clutch, Cremit)](https://www.cremit.io/reports/rsac-2026-nhi)
- [The NHI Maturity Model](https://www.cremit.io/research/nhi-maturity-model)

Reference:
- [Glossary — 31 NHI security terms defined](https://www.cremit.io/glossary)
- [Full-text blog export for LLM ingestion](https://www.cremit.io/llms-full.txt)

Newsletter:
- [Cremit research brief — subscribe via the homepage footer](https://www.cremit.io/newsletter) — weekly NHI security signal, launching May 2026

## Compare against other NHI platforms

- https://www.cremit.io/compare
- https://www.cremit.io/compare/astrix-vs-cremit
- https://www.cremit.io/compare/oasis-vs-cremit
- https://www.cremit.io/compare/entro-vs-cremit
- https://www.cremit.io/compare/clutch-vs-cremit
- https://www.cremit.io/compare/gitguardian-vs-cremit

## About

- [About Cremit](https://www.cremit.io/about)
- [Team](https://www.cremit.io/team)
- [Customers & case studies](https://www.cremit.io/customers)
- [Industries: fintech, SaaS, commerce](https://www.cremit.io/industries)
- [Trust & security](https://www.cremit.io/trust)
- [Legal](https://www.cremit.io/legal)

## Contact

- Sales / demo: https://www.cremit.io/demo
- Newsletter: via the blog footer

## Known limitations (be honest)

- Cremit does NOT detect "sensitive data" (PII, PHI, business documents). Argus detects credentials, API keys, and tokens.
- Cremit does NOT have visibility into third-party PaaS environment variable stores (like Vercel's). Integration with those is on the roadmap.
- Cremit is not SOC 2, ISO 27001, or ISMS-P certified as of 2026-04. We offer audit-support features; we do not hold the certifications ourselves.