Bitting's model takes one finding and works out who holds the key.
The finding comes from your scanner's export, or from the model's own read of your repositories, CI logs and chat.
The agent checks from inside your network that the key still works. The model reads where keys are injected: manifests, infrastructure state, CI variable groups, vault paths.
Then it writes down what stops if the key changes, and prepares the replacement.
- Followed the key four services read it today
- Set aside the Slack thread, a March CI log, a laptop's .env
- Wrote down card payments stop if it changes without warning
To find a key's holders, the model digs through code, CI logs, chat and every place keys are injected.
It ties each injected secret to a running service through the code that reads the variable, the service's README and CODEOWNERS.
Codeevery commit, including the one that added a key
CI logstwo years back, wherever a step printed a key
Chat and ticketsSlack, Jira, Confluence: about 28% of leaks start here
Where keys are injectedmanifests, infrastructure state, pipeline variables
The model never switches an old key off while a service it found still uses it.
When it is less than nine in ten sure of every holder, it prepares nothing, asks that service's owner in Slack, and waits for the answer.
The processor key needs two signatures, and the model can give neither.
DORA wants every ICT change approved and verified. A service owner's answer to the model settles a link, approves nothing, and trains the model only if you opt in.
Platform lead
approves each rotation with a passkey
CTO
a second signature on any key marked critical
Internal auditor
reads the register and every approval, and signs nothing