ProductExternal Scanning
See the assets and keys your company exposes publicly.
Start with a domain or GitHub organization to find related public assets and the evidence connecting them. Monitor exposure on supported web and app assets, and configure secret checks for keys left in public content.
- Attack surface owner
- Security lead
- Infrastructure owner
Who does the work
The people this feature hands work to, and what each of them does with it.
Attack surface owner
Registers domains and GitHub organizations and reviews the assets proposed from them.
Security lead
Decides which discovered assets are in scope and which to exclude.
Infrastructure owner
Confirms the assets that belong to their team and fixes exposed keys there.
Follow one external asset
This is an editorial explanation of the workflow, not a product screenshot or customer record.
01
Register a seed
Start with your organization’s domain, GitHub organization or another supported asset.
02
Read public evidence
Certificates, DNS and public links can point to related assets and attribution clues.
03
Monitor supported targets
Eligible discoveries can be monitored without waiting for individual approval. Excluded assets are skipped.
04
Review the finding
Use the location and coverage record to decide what needs investigation.
What starts discovery, and what can it find?
Discovery starts from assets your organization registers. A link to an asset is evidence to review, not proof that your organization owns it.
- Registered seeds
You can register a domain, website, API endpoint, IP address, iOS or Android app, or GitHub organization. Subsequent discovery and checks depend on the type.
- Public clues
Candidates can come from public certificate names, DNS addresses, linked APIs, app association files and qualifying public commits. These signals do not establish ownership on their own.
- After discovery
Supported domains, websites, API endpoints and apps can enter monitoring automatically. A derived IP may belong to a CDN, so it is not treated as an owned host. An asset you explicitly exclude is not scanned again.
What does a scan actually read?
Reachability and secret detection are separate stages. Read the enabled settings and coverage alongside each result.
Reachability
Bounded public requests check whether a supported target responds and how. Cremit does not sign in, submit forms or exercise vulnerabilities. Monitoring is not limited to headers alone.
Content secret checks
When the organization’s secret scanning setting is enabled, supported targets can be checked for credential-like values in public HTML, JavaScript and JSON. Document, byte and time limits apply.
Optional deeper checks
Depending on settings and access, the scanner may read linked JS chunks, selected source maps, same-host app files or Android packages whose signatures it can verify. This does not cover every app binary or source map.
What a finding means
Location, rule match and validity are distinct evidence. Actual use needs a separate investigation.
Public location
A result records the public origin and observation time. Detailed locations are encrypted and available in inventory when they can be resolved.
Secret match
A detection rule matched a value. Review context and possible false positives; a clean result covers only the inspected material.
Validity and response
Supported credential types may receive an issuer-side validity result. A live key does not prove misuse. A person checks issuer logs and access context, then rotates or revokes the key at its issuer.
Common questions
Do discovered assets wait for approval before scanning?
No. Currently supported discoveries can enter monitoring automatically. Explicitly exclude an asset or pause its monitoring if it is outside your scope. Organization rollout and settings still apply.
Is domain ownership verification required?
It is a separate trust signal, not a prerequisite for monitoring. Neither a discovery clue nor a monitoring state establishes ownership.
Does a clean result mean there are no public keys?
No. It means this run found none in the material it inspected. Review failures, skipped documents, limits and whether optional deeper checks ran.
Does Cremit revoke detected keys automatically?
No. Cremit provides the finding and evidence for review. The responsible person rotates or revokes a key at its issuer.
Continue the investigation
Connected-source scanning and external scanning start from different places. Review location and validity evidence separately for either kind of finding.