Safe fingerprinting
Use keyed HMAC-SHA256 fingerprints, prefix/suffix hints, repository metadata, detector name, confidence, and status.
KeyControl web SaaS
Machine identity exposure response without raw secrets.
KeyControl helps security teams find risky machine identities, exposed secret indicators, stale API keys, overprivileged service accounts, and CI/CD credentials, then map ownership, blast radius, remediation plans, approvals, and audit evidence.
Status: coming soon. Platform: hosted browser-based SaaS for machine identity and cloud security teams. Findings use safe HMAC fingerprints and metadata; raw discovered credentials are not stored.
Machine identity response
Response workflow
Turn exposed credential indicators into safe remediation work.
KeyControl maps safe findings to owners, affected systems, blast radius, remediation state, approvals, and retained evidence without exposing the underlying secret value.
1Safe finding
2Owner resolution
3Blast radius
4Dry-run plan
5Audit evidence
Core capabilities
Control machine identities before exposed secrets become incidents.
KeyControl is built around safe metadata, explicit ownership, reviewed remediation, and evidence that security and audit teams can review.
Machine identity map
Track AWS IAM users and roles, GitHub Apps, CI/CD secrets, service accounts, bot accounts, and credential references.
Blast-radius context
Explain what each identity can reach, which resources are sensitive, and how rotation affects service continuity.
Approval-gated remediation
Plan rotation, disablement, deletion, quarantine, or exception workflows through dry-run and human approval first.
Response model
Separate detection metadata from destructive execution.
KeyControl keeps raw secrets out of persistence, UI, API responses, logs, tests, seed data, and telemetry. Production connectors should use least-privilege read-only inventory and separate approval-gated execution roles.
Safe import and findings
Store provider, secret type, safe fingerprint, repository context, timestamps, confidence, and evidence summary only.
Owner and workflow routing
Resolve likely owners through repository metadata, CODEOWNERS-style rules, tags, and operational context.
Dry-run remediation
Validate replacement, rotation, disablement, monitoring, and deletion plans before live action is approved.
KairnexEvidence export
Send safe fingerprints, owner and blast-radius metadata, remediation status, approvals, and audit evidence.
Security boundaries
Defensive blue-team response only.
KeyControl does not scrape public repositories, use discovered credentials to authenticate, collect raw secrets, or build offensive tooling. It is designed for authorized defensive response inside customer-approved environments.
No plaintext secrets, API keys, passwords, cookies, private keys, session material, raw tokens, or raw credentials stored
Safe HMAC fingerprints and sanitized metadata only
Cross-tenant access is treated as a security failure
Destructive remediation requires approval and typed confirmation
Every sensitive action creates an immutable audit log entry