A leaked secret is the beginning of the investigation.

Follow a fictional API token from exposure to workload ownership, permissions, activity evidence and remediation. Explore why secrets detection, NHI security and IAM are related—but not interchangeable.

From leaked secret to identity risk

Synthetic example: a possible API credential is detected in a fictional repository commit. Explore how distinct detection methods, identification, verification, blast radius, investigation and remediation differ. No real credentials are used or verified.

Detect

A candidate secret was found by provider signature. Known provider-specific prefixes or key formats. Strong for recognizable credentials but cannot cover every custom format. Detection alone does not establish validity, identity or compromise.

Git repositories and history

Method: Provider signatures, regex, entropy, structured parsing, diff scanning

Evidence: Candidate credential and exposure location

Limitation: A match does not prove validity or exploitation; history may be incomplete

Example: TruffleHog / git scanning

Read reference

CI logs, artifacts and images

Method: Artifact scanning, contextual and structural matching

Evidence: Potential exposure beyond source code

Limitation: Access permissions and available retention vary

Example: CI artifact or container scan

Read reference

Illustrative sources, not live connectors. No credential data is sent to external services.

Change the fictional evidence

Educational triage result

Review and collect evidence

Not a production risk score, incident severity, or claim of malicious use.

Remediation checklist

  1. Detect and triage candidate secrets using patterns, provider signatures, entropy, structural checks and context.
  2. Identify credential family, provider, workload identity, owner and exposure location before verifying.
  3. Verify status only by approved, non-destructive means; preserve unknown when checks are not possible.
  4. Map effective privileges, resource reach, production access and data sensitivity to estimate blast radius.
  5. Correlate exposure timeline and authoritative audit logs; do not equate exposure with confirmed compromise.
  6. Revoke or rotate, reduce privilege, eliminate insecure storage, investigate impact and validate service recovery.
Explore identity journeysDetector Coverage AtlasSecurity Market Map

The Atlas explores detector capabilities and limitations. The Market Map documents market categories, vendors and evidence. This lab uses neither project's live data; its findings are fictional.