At Cloud Village
Cloud Village ran a cloud-focused CTF from March 24 to 26 at RSAC 2026. Cremit and Beaver Dam Community competed together under the Cremit name and finished second. The event photos and scoreboard below document that result.
A CTF tests how participants solve its challenges under time pressure. It does not test the detection rate or response workflow of a commercial product.
What the public sources show
These points have different origins: one published measurement and three vendors’ descriptions of their own products. They are not a head-to-head product test.
Public GitHub leaks
GitGuardian counted 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34% from 2024. That measurement covers public GitHub commits; it is not a count of every exposed credential.
GitGuardian, State of Secrets Sprawl 2026Credential discovery
GitGuardian documents scanning repositories and connected collaboration sources. Test the sources and credential types your team uses, including which results support validity checks.
GitGuardian source integrationsIdentity lifecycle
Oasis documents provisioning, monitoring, rotation, attestation and decommissioning workflows. In a trial, check the issuers, approvals and rollback steps that apply to your environment.
Oasis lifecycle governanceAgent and resource relationships
Astrix describes an identity graph connecting AI agents, NHIs, secrets, owners, permissions and resources. Check whether it traces one real agent through the resources it can reach.
Astrix AI agent discoveryFour questions to take into a trial
- 01
Where was the credential found?
Connect a repository, a document or chat source, and a cloud location you actually use. Keep the original location as evidence.
- 02
Is it still valid?
Use a supported test key and check whether the tool verifies it with its issuer. Record unsupported types separately.
- 03
What can it reach?
For supported cloud keys, compare the resources and permissions reported with the issuer’s own view.
- 04
Who will act?
Check whether the finding reaches a named owner, what the response steps are, and how closure is recorded.
For current vendor-by-vendor scope and direct source links, use the platform comparison. This page records a March 2026 event; product features may have changed since then.
Sources and attribution
The CTF result is attributed to the Cremit × Beaver Dam collaboration. The event schedule comes from Cloud Village. The secret count is GitGuardian’s own measurement. Vendor capabilities are summarized from their product pages, reviewed October 4, 2026. Cremit wrote this report and has not independently tested the competing products for this article.