ContactBook a call
Menu

The processor key went into Slack at 02:10, and nobody took it back out.

The firm is an example: a Vilnius e-money institution of about 140 people, three of them on infrastructure.

  1. February, 02:10the key is pasted into the incident thread
  2. 2 Septemberthe auditor asks for the key register
  3. 9 Septemberthe scanner finds it among 1,140 findings, still live

Everyone has seen this thread. 02:07, settlement is failing and the person with access is asleep. 02:10, someone pastes the card processor's key. 02:14, running again.

In September a scanner found it among 1,140 findings, called the processor's API, and confirmed it still works.

Nobody could say which services hold it, so its rotation waits for a maintenance window and the register has a gap. That question is the model's job.

The finding once the model read it: card processor key, found in Slack, a March CI log and a laptop's .env file; still works; four holders; card payments stop.

The same finding, after the model has read around it.

A scanner gives you one line. The model adds where else the key turned up, whether it works today, who holds it and what stops.

  • Also founda March CI log and one laptop's .env file
  • Still workschecked today, from inside your network
  • Held bycard authorization, disputes, the settlement job, the deploy pipeline
  • If it changes without warningcard payments stop first

Over 64%of keys valid in 2022 still worked in January 2026

A key pasted last winter is most likely still live today.

GitGuardian, State of Secrets Sprawl 2026, retesting credentials it had confirmed valid in 2022.

Leaked keys are rarely replaced. The processor key from February was still working in September.

Validation-only triage misses 46% of critical secrets, so Bitting sorts keys by who holds them and treats one it cannot check as live.

The platform lead's objection

"We'll triage it ourselves, in a sheet."

That sheet already exists. Two of the firm's three infrastructure people have spent weeks testing keys, grepping manifests and Terraform state, and asking in Slack who reads what.

The model fills 'Who holds it?', the column nobody could. And an auditor reads a register with a replacement method, not a sheet.

What the model does
A triage sheet: where found, what it is, still works, who holds it; question marks and 'ask the team' in the last column; 1,140 rows sorted by still works.
A triage sheet like the example firm's: 1,140 rows sorted by 'still works', and question marks under 'Who holds it?'.

Your request has been received.

Expect a message from Bitting. It goes to the address you gave.