Skip to main content
NEW · Blast Radius: a field playbook for leaked API keys on AWS, GCP and Azure

ProductWorkflow Automation

Route the finding. Keep the fix accountable.

Choose what happens when Cremit finds a live secret or creates an incident. Secret triggers can send notifications; incident workflows can also update priority, status and ownership. A responder still rotates or revokes the credential at its issuer.

See a demoHow scanning works
  • Security operations
  • Team lead
  • Responder
Valid secret foundPublic?Notify channelAssign ownerSet priority

Who does the work

The people this feature hands work to, and what each of them does with it.

  • Security operations

    Defines the triggers, conditions and actions once, instead of routing by hand.

  • Team lead

    Receives incidents routed to their team with an assignee and a priority.

  • Responder

    Works the incident from the alert without re-triaging it.

Cremit workflow triggers and their available actions
The real product interface, shown with a fictional sample organization.

The trigger decides which actions are available

These are separate workflow events. An active-secret finding does not automatically have an incident to assign or change.

  1. ACTIVE_SECRET

    A verified active secret

    A supported detected credential is found to be active.

    Available actions

    Notify a channel or the author, if that action is configured.

  2. PUBLIC_ACTIVE_SECRET

    An active secret with public exposure

    A detected credential meets the public and active trigger conditions.

    Available actions

    Notify a channel or the author, if that action is configured.

  3. INCIDENT_CREATED

    A new incident

    An incident has been created and matches an enabled workflow.

    Available actions

    Notify a channel, assignee or author; set status or priority; reassign the incident.

Common questions

Does a live secret automatically become an incident?

No. Secret triggers can notify a channel or author. Incident creation depends on a separate configured rule; only a new incident can trigger incident status, priority and assignment actions.

Does Cremit rotate or revoke keys?

No. The owner performs that change in the issuing service. Cremit provides detection, supported validity checks and response routing.

Can the workflow message the person who committed the secret?

Yes, when the author can be identified, the action is configured, and the Slack connection has the permissions needed for author direct messages.

Start with the evidence

Review where credentials came from, how they were verified, and who should act. Then configure the workflow around your response process.