A teammate proposes confirming a flagged credential by calling the service with it — whose records does that attempt land in?

## What the test is for A scanner reports that a string in a file looks like a credential. That is a claim about text. A validity check turns it into a claim about the world: *this is accepted, right now*. The difference matters because it changes what happens next — a value that nothing accepts is cleanup, and a value that still works is an exposure with a clock on it. So the instinct to check is sound. What is usually missing from the proposal is where the evidence of the check ends up. ## Whose record it lands in The attempt is not logged where you sit. It is logged by whatever authenticated it. | Who holds the record | What they see | Why that is awkward | |---|---|---| | The accepting service | a successful authentication as the credential's identity, from your address, at your time | indistinguishable from the abuse being looked for | | Another organisation's service | their counterparty's credential used from an address they have never seen | may start their incident process, with you as the suspect | | Your own accepting system | one more successful use in the very record an investigation will later read | your test now has to be told apart from real use | That last row is the one people underestimate. If this find turns into a real exposure, someone will reconstruct who used the credential and when. Every test call added to that record is noise a colleague has to explain away months later, which is why a test — if it happens at all — is worth recording at the time: who ran it, from where, at what minute, against what. ## What a success proves, and what it does not A successful call establishes something genuinely narrow: - the credential is accepted **for that operation**, not for everything; - **from that network position**, which may be allowed where others are not; - **at that moment**, which says nothing about a lifetime that may end in an hour; - by **that one service**, which says nothing about other systems that trust the same value. What it does not establish is reach. Mapping what a credential can actually touch means probing more of it, and every extra probe adds another entry to somebody's record. Scoping is a different job with a different answer, and it is not what a confirmation call is for. ## What a failure proves Less than people assume. A rejection is consistent with the credential being dead, and equally consistent with all of these: - an address or network restriction that your test tripped and normal use does not; - a missing right for the specific operation you chose, while other operations still work; - a rate limit, a lockout triggered by earlier attempts, or a transient outage; - a malformed value, because the string was truncated or re-wrapped by the file it sat in. So a failed test is weak evidence of safety, and treating it as proof is the more dangerous of the two mistakes — it closes a finding that is still live. Note also that alerting on failed authentication would not have caught the real abuse of this credential anyway: a working stolen credential **succeeds**. ## Cheaper ways to get the same answer 1. **Ask the issuing side.** Whoever minted the credential can often say whether it is current without anyone using it. 2. **Read the accepting system's own records.** If it shows the credential in use from places that are not your systems, you have your answer and more. 3. **Use a call with no side effect.** Where you must call, choose the operation that only reports which identity is calling, never one that writes, deletes or spends. 4. **Use an issuer's status facility where one exists.** Designs differ: some issuers offer a way to ask whether a credential is current, others offer nothing and using it is the only signal available. ## When not to test at all If the credential is not yours — found in a fork, in another organisation's repository, or belonging to a supplier — using it is unauthorised access to someone else's system, whatever your intent. The correct move is to tell the owner. The same applies to a credential belonging to a customer: your test would be an access to their account that they did not authorise and that their own records will attribute to them. What you do once you know the credential is live — the order of withdrawal, replacement and cleanup, and who is told — is a separate subject. This question is only about what a test call proves and what it costs to make it.