SECRET SCANNING
Where did the key appear?
Scan connected repositories, documents, storage and messages. GitHub pull requests can be checked on arrival; other connected sources are scanned on a schedule.
CREMIT / PRODUCT
Manage API keys and tokens with a clear owner and next step.
Know where a key was found, whether a supported issuer check confirms it works, and who should act. Cremit brings findings and verification results into a credential inventory. Review your existing vault and team-sharing requirements alongside that workflow.
What changes as evidence arrives
Each step answers a different question about the same credential.
- 01
Source
Where was it found, and was that location public?
- 02
Validity
For a supported type, what did the latest issuer check show?
- 03
Access
What AWS policy or GCP API restriction data is available?
- 04
Owner
Who is responsible for issuer-side containment and follow-up?
Discover
Start with a recorded source and keep scanned findings distinct from vault entries and manually registered assets.
EXTERNAL SCANNING
What is exposed beyond connected sources?
Register a domain or GitHub organization, review public discovery evidence, and exclude any supported assets that should not be monitored.
IDENTITY INVENTORY
What kind of record is this?
Review scanned findings alongside secret-manager entries and manually registered assets, with each record’s origin visible.
Investigate
Exposure, validity and permission context need separate evidence. Read them together before deciding priority.
THREAT DETECTION
Does the credential still work?
Review public-exposure context and the latest issuer result for supported types. Available AWS or GCP analysis adds permission context.
CREDENTIAL GRAPH
How is this finding connected?
Trace typed links to source locations, authors, assigned owners, vault records, incidents and available permission data.
Respond
Configured rules can move information and incident records. The credential itself must be changed at the issuing service.
WORKFLOW AUTOMATION
Who gets notified or assigned?
Secret triggers can notify a channel or author. A matching incident workflow can also set priority, status and assignment.
OFFBOARDING REVIEW
Could an inactive account still be linked to keys?
Compare directory account status with recorded author or assigned-owner evidence, then check supported validity and hand off a review.
Three practical questions about API key management
A key’s location, approved store and dependent workloads each tell you something different about the next step.
- Is deleting a key from Slack or code enough?
Removing the message or code does not revoke the key at its issuer. Record where and when it was found, identify dependent services, and have the responsible team replace or revoke it. Cremit helps you review findings, check supported types and assign the investigation.
See the secret scanning workflow- Why scan for secrets if we already use a vault?
A vault is the approved store. Copies made during development may still be present in code, documents or messages. Cremit’s inventory distinguishes scan findings from entries synced from your secret manager so you can review the evidence from each source.
Review findings and vault entries- Does offboarding an employee disable their API keys?
Disabling a company account may leave separately issued keys usable. Check the issuer, current owner and dependent workloads before handing over or replacing access. Cremit helps review active credentials found in material authored by inactive directory users. Authorship alone does not establish current ownership.
Review credentials during offboarding
Bring storage and sharing into the same workflow
Start with where API keys and tokens should live and how your team and workloads receive access. Use these requirements to discuss a Cremit Vault and team credential hub setup.
- Storage and migration scope
- Identify credentials that should stay in an existing vault and those you want to migrate. Record the store, access permissions and owner responsible for replacement.
- Team sharing and ending access
- Distinguish keys people need to retrieve from credentials consumed by workloads. Define how access ends on a team change and how to replace copies already shared.
If you already use a secret manager
The inventory syncs entries from your connected secret manager read-only. Syncing does not migrate a key into Cremit Vault or rotate it at the issuer. Confirm which secret managers, native storage and sharing apply to your setup during a product discussion.
Connect the evidence sources you use
These are examples of distinct connection types. The full catalog shows setup and scope for each integration.
- GitHub scanning
Scan a connected repository and check pull requests through the GitHub App.
- AWS permission analysis
Use a scoped cloud integration to review available AWS access-key identity and policy context.
- Slack alerts
Send configured finding and incident notifications to a channel.
- Okta directory sync
Use SCIM account status as one input to offboarding review.