Security teams have tools for code, endpoints, cloud infrastructure, identity, and secrets management. Credentials cut across all of them. A developer finds an AWS key in a repository. The first step is obvious: remove it. But that does not answer the questions the security team now has: Is the key still active? Who owns it? What can it access? Is the same credential sitting in a CI/CD variable, a local .env file, a Slack thread, …