hunting-non-human-identity-and-secret-reachability

# Hunting non-human identity and secret reachability: existence is not the bug, reach is A secret scanner tells you a credential is present. That is a lead, not a finding. The questions that decide severity are different: is this credential still valid, how much does it grant, and can an attacker actually reach it? A dead key in old history is noise. A live, broadly scoped token that an untrusted path leads to is an incident. Machine identities now vastly outnumber human ones, so the volume is overwhelming; the method that matters is separating reachable and powerful from merely present. ## When to use - You are reviewing secret exposure or the machine identities in a system. - A scanner reports many secrets and you need to know which are exploitable. - You want the blast radius of a leaked credential, not just its location. ## Scope check Inventory and validate credentials in systems you own or are authorized to test, and test validity only against your own accounts. If you can't name the authorization, stop. ## The loop 1. **Inventory the machine identities and secrets.** Enumerate credentials across source, configuration, infrastructure definitions, build output, and runtime surfaces: keys, service-account credentials, and long-lived tokens. Record where each lives and which identity it belongs to. This is the candidate set, not the finding set. 2. **Determine reachability.** For each credential, ask who can reach where it sits. A secret in a public ...