Secret Debt Assessment

I also do this: a read-only secret-debt assessment across your organization’s repositories, delivered as a prioritized remediation report.

It comes from a gap I kept seeing. Your secret scanner is probably already running—gitleaks, GitGuardian, GitHub’s secret scanning, anyone’s—and it’s producing a wall of findings nobody is triaging. The scanner did its job. Detection is the solved half. The unsolved half is the wall: 289 rows, and no list you can act on. The report becomes the alert nobody opens, and the secret debt just sits there.

What I do

I run a read-only assessment across your repositories, verify liveness, and hand you a prioritized remediation report:

• Rotate Today—confirmed live exposures with high impact.
• Rotate This Week—validated credentials with lower immediate risk, or unverified against providers that can’t be checked automatically.
• Log and Ignore—confirmed noise, placeholders, test strings, historical ghosts.

I identify the problem and hand you the list. You do the rotating, on your side. I don’t touch your code, and I never read or store your secret values.

How access works

The assessment is read-only. You grant a GitHub token scoped to contents:read and metadata:read at the organization level—time-bound and revocable by you at any moment. For cautious teams, a client-run variant is available: you run the scan inside your environment and send me the raw findings. A mutual NDA comes first.

Who it’s for

Engineering leaders whose repositories have grown faster than their secret hygiene—often a scanner already running and no one whose job is to triage the findings. If you can’t tell a live exposure from a placeholder, the assessment is what turns the wall into a list you can act on.

It’s not for teams that want the rotation done for them. I hand you the prioritized report; the rotations are yours.

Where to read more

The full offer, the trust model, and how to request an assessment are at Unrotated Security. Or write to me directly at harvey@harveyramer.com. (If you’d rather run the triage yourself, the method is in How to triage secret scanner findings.)