Validation
Discovered credentials are checked read-only against live provider APIs. Results are stored with evidence and drive the decision engine — so the queue starts with confirmed-active exposures.
Providers
| Provider | Read-only check |
|---|---|
| GitHub | GET /user |
| AWS | STS GetCallerIdentity |
| Stripe | read-only charges list |
| Azure | AD token endpoint |
Categories & outcomes
Validation categories: FULL · PARTIAL · STRUCTURAL · CONTEXT. SSH keys and certificates receive structural (format-only) validation; database URIs get partial checks.
Correlation engine
Multi-component secrets are assembled before validation — an AWS access key ID found in one file is paired with its secret access key found elsewhere, so validation tests the real credential, not a fragment.
Triggering
POST /agent/findings/{id}/validate
# or run the full agent loop:
POST /agent/run/newValidator credentials (e.g. AWS) are optional dependencies — without them, findings resolve as UNVERIFIED rather than failing. The validator registry is pluggable; new providers register against the same interface.
Source: tools/ (validators) · domains/validation/ · PRODUCT_ANALYSIS §5.1