Credential Half-Life Scorecard
A worm stole your npm token twenty minutes ago. It is already publishing. Nothing here asks whether you would have caught it — in the August 2026 keyv compromise the malicious packages were correctly signed and passed provenance checks, so detection was not the deciding factor. What decided each victim's blast radius was how long a stolen credential stayed useful. Eight questions, and every one assumes the token is already gone.
Written after the keyv and cacheable compromise — where valid signatures and passing provenance stopped nothing, and credential lifetime decided everything.
How long is a package-publishing token (npm, PyPI, crates) valid for?
Loading…
Sample report · illustrative data
Sample result: Credential Half-Life Scorecard
Example answers to the 8 questions (one per domain, each scored 0 to 3) for an invented team, all assuming a publishing token has already been stolen.
Overall
- Overall score
- 50% (12 of 24 points)
- Rating
- Amber
- Weakest domains
- CI Credentials, Cloud Keys, Install-Time Execution, Agent & Editor Trust
By domain
| Domain | Score | Percent | Rating |
|---|---|---|---|
| Publishing Credentials | 2 / 3 | 67% | Amber |
| CI Credentials | 1 / 3 | 33% | Red |
| Cloud Keys | 1 / 3 | 33% | Red |
| Revocation Speed | 2 / 3 | 67% | Amber |
| Blast Radius | 2 / 3 | 67% | Amber |
| Install-Time Execution | 1 / 3 | 33% | Red |
| Agent & Editor Trust | 1 / 3 | 33% | Red |
| Detection of Use | 2 / 3 | 67% | Amber |
How to read it
Green is 80% or more, Amber 50% to 79%, Red below 50%. It is an indicative self-assessment, not an audit, and it is weighted toward package-publishing and CI credentials rather than a full identity review. The questions ask how long a stolen credential stays useful, not whether you would have prevented the theft.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.