# AI credential-scanning review

Copy this record for each provider, credential class and scanner under review.
Use references or protected finding identifiers, never raw secrets or personal data.
This blank template contains no measured coverage or verification results.

## Integration and ownership

- Provider or gateway: Not recorded
- Credential class (including upstream versus gateway access): Not recorded
- Responsible team or role: Not assigned
- Review date: Not recorded

## What was scanned

- Authorized repository or source reference: Not recorded
- Snapshot or commit reference: Not recorded
- Branches, tags and history scope: Not assessed
- Exclusions and collection failures: Not assessed
- Scanner and exact version: Not recorded
- Detector or ruleset reference: Not recorded
- Verification configuration and permitted destinations: Not assessed

## What the fixture established

- Authorized test plan and fixture reference: Not recorded
- Pattern-detection outcome: Not assessed
- Historical-fixture outcome: Not assessed
- Verification outcome (not attempted / succeeded / failed / inconclusive): Not assessed
- Error and reporting-filter review: Not assessed
- Comparison with another scanner, if useful: Not assessed
- Evidence references: Not recorded

Synthetic markers can exercise pattern detection without being valid credentials.
Use only explicitly authorized, isolated test credentials for live verification.
Do not publish a valid credential as a test fixture or test third-party leaked keys.

## Response and follow-up

- Finding reference and owner assignment: Not assessed
- Exposure or containment decision: Not assessed
- Test-credential revocation and confirmation reference: Not assessed
- Remaining coverage gaps: Not assessed
- Next review trigger or date: Not recorded

A missing match is not proof of no exposure. Keep collection failures, excluded
sources and inconclusive verification visible in the final assessment.