Concepts

Credential leaks

Per-credential correlation of rotation, usage, privilege, and exposure into one profile — confirmed only when risk and exposure share the same credential id.

Credential Leaks rolls every signal about a single credential — its rotation history, usage, privilege, and exposure — into one prioritized profile. The premise is simple: a detected leak only matters if the credential is still live and reachable. Correlating per credential separates "a key was once seen in a log" from "a privileged, still-active key is exposed right now."

The confirmed-leak rule

A CONFIRMED LEAK badge lights up only when a risk signal and an exposure signal share the same credential id — never an inferred link. A risk-only profile is still prioritized, but it is never inflated to confirmed. We don't declare a leak on a guess. This is the load-bearing honesty rule for the whole screen: the badge means the two signals are the same credential, not two things that might be related.

What each profile shows

Expand a credential to read a plain-language cross-domain explanation, the individual signals that contribute to it, and links to the underlying findings. The profile is prioritized by the combined risk so the credentials that actually need rotation rise to the top.

Where you see it

Credential Leaks reads GET /api/credential-leaks. The screen is mounted at /credential-risk (the V1 product already owns the /credential-leaks route). See it in the Posture screens overview.