# Credential investigation worksheet

Cremit Research · Blast Radius web exercise supplement · 2026-10-07
Source: https://www.cremit.io/research/blast-radius#investigation-exercise

Copy and edit locally. Do not put raw keys, tokens or private keys in this document.
Record masked identifiers and access-controlled evidence locations only.
Use fictional data for practice. Blank fields or missing logs do not establish an all-clear.

## 1. Identity and responsibility

- Investigation ID:
- Issuer / credential type / masked identifier:
- Issuer identity (account, role, etc.) and evidence:
- Finding location (exclude sensitive query strings and values):
- Author candidate and basis for the inference:
- Confirmed owner / confirmation time / evidence:
- Dependent services / replacement owner for each service:

## 2. Timeline and exposure (UTC)

| Event | Time or interval | Evidence location | Observed / inferred / unknown |
| --- | --- | --- | --- |
| First observation | | | |
| Lower and upper bounds of exposure start | | | |
| Public or shared scope checked | | | |
| Issuer verification | | | |
| Issuer replacement or revocation | | | |
| Follow-up check | | | |
| Source cleanup | | | |

## 3. Possible access and actual use

- Current permissions and collection time:
- Assumable roles and reachable secret stores:
- Availability of historical permissions and change records:
- Investigation period / log types / collection coverage:
- Logging disabled, retention expired or uncollected intervals:
- Observations supporting actual use / unresolved questions:

## 4. Actions and remaining work

- Replacement order for dependent services and impact checks:
- Issuer action reference, time and result (no raw secrets):
- Existing sessions and derived tokens: expiration or separate invalidation:
- Follow-up verification time, method and result:
- Remaining exposure in source, caches, images and history:
- Open item / owner / next checkpoint:

## 5. Conclusion

- Established facts:
- Questions that cannot be answered from available evidence:
- Scope of closure and remaining follow-up:
- Reviewer / review time:

Example conclusion: the issuer revoked the key and a follow-up check failed authentication.
Historical data access is undetermined because data-access logs for that period are missing.
Record current key containment, historical-use investigation and derived-session checks separately.