It finds the keys on a machine and checks, read-only, what each one can reach, so you know which to rotate first. Below is a fake laptop with six credentials. Change them and watch the ranking update.
Click a credential and change where it lives or what it can do. The score and rotation order recompute with the tool's own code. Try the npm token: raise its downloads, then make it read-only.
Most issuers use a distinctive prefix now, so those are matched exactly and the false-positive rate is near zero. Everything else falls back to context plus randomness, and that is where naive scanners embarrass themselves: development-mode-enabled clears three bits per character comfortably. So a value also has to mix character classes, and a placeholder list catches the rest. Edit the box and watch the verdicts change as you type.
"We were careful" is not a control. So every network call goes through one transport that can only make calls a probe declared in advance, with a written reason.
GET and HEAD are the only methods permitted. A POST has to carry a justification for why the endpoint is read-only despite the verb, or registration itself throws. Anything undeclared is refused before a socket opens.
Three of the sixty-five tests exist purely to hold that line: no undeclared call, no unjustified write verb, and no secret surviving into any output. Every report also carries the audit as data, so the guarantee is checked on every run rather than asserted in a readme.
Some providers are deliberately not probed, and the report says which and why. A live Stripe key should not be exercised by a discovery tool even read-only, and testing an ssh key means connecting somewhere, which is not a read-only act.
On the laptop this was built on: ~/.npmrc did not exist. ~/.aws/credentials did not exist. ~/.config/gh/hosts.yml held a username and no token. ~/.docker/config.json held credsStore and an empty auths object. Every one of those credentials was real and present. They were all in the login keychain.
The keychain is genuinely better than a dotfile, but better is not out of reach. A credential helper is a program that hands the secret to whoever asks in the right format, and the helpers are already on the keychain's access-control list, so they never prompt. An attacker with code execution as you does not defeat the keychain — they ask git for it. So the tool asks the same way, and scores the result accordingly.
Read-only means read-only, not invisible: every probe authenticates, so it shows up in the provider's audit log. That is usually what you want after a suspected leak, but it is not a stealthy operation. Unverifiable credentials are marked estimated and never presented as measured — an ssh key's real reach is whatever hosts trust it, which cannot be enumerated from the client.