Finding things
Live credential verification
The strongest signal the product produces: not that something looks like a key, but that the provider was asked and said it still works.
How it works
A candidate credential is sent to the service that issued it, using that service's own token introspection or identity endpoint. AWS, Slack, Stripe, GitHub, Google and a long list of others. A verified finding outranks everything else on the page, whatever its severity would otherwise have been.
Why it changes the conversation
On one corpus of two thousand two hundred credential findings, nine were verified live. That is not an argument that the rest are fake, because verification only works where the issuer offers a check. It is an argument about where to start on Monday morning.
It can be turned off
Verification is an outbound call to a third party carrying a candidate secret. Some environments will not allow that, and one flag disables it for the whole run.
What it does not do
Only covers providers that publish a way to check. A verified finding is a fact; an unverified one is not evidence of anything either way, and the product does not treat it as such.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.