> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/prevention-tools/credentials.md). # Credentials The `Credentials` section gives you a dedicated view of everything Stoïk has found related to leaked credentials and compromised devices for your organisation.

:database:

Exposed Data

Browse every leak found about your organisation.Exposed Data

:key:

Valid Credentials

Fix a leaked password that still works.Valid Credentials

:user-lock:

Leaked password

Why Stoïk does not share it, and what to do instead.Leaked password

:laptop:

Infected devices

Handle a device compromised by infostealer malware.Infected devices
## How it works Stoïk Protect is connected to three external intelligence providers: * **LeakCheck** monitors public data breaches: incidents where a company's user database was hacked and dumped online. * **Hudson Rock** and **Flare** collect infostealer logs: data silently exfiltrated from employee devices infected by malware. From the assets you've declared in the [External Scan](/prevention-tools/external-scan/configuration.md) (domain names, IP addresses), Stoïk continuously queries these providers for anything related to your organisation. Results flow into two tabs: **Exposed Data** and **Alerts**. ## What Stoïk looks for * Every email address on a domain declared in the External Scan, or found by it, including domains that redirect to yours. * Not personal addresses (Gmail and others), even when an employee uses them for work. * For prospects, Stoïk collects leaks but does not test passwords: Valid Credentials alerts only exist for customers. ## Exposed Data Exposed Data is the full intelligence feed: every piece of data Stoïk has found leaked about your organisation online. An entry does not necessarily mean the credential still works today. See [Exposed Data](/prevention-tools/credentials/exposed-data.md). ## Alerts Alerts are what Stoïk has actively confirmed needs immediate action. There are two types: * **Valid Credentials:** a leaked login and password that still grants access to one of your services. See [Valid Credentials](/prevention-tools/credentials/valid-credentials.md). * **Infected Device:** an employee device identified as compromised by infostealer malware. See [Infected devices](/prevention-tools/credentials/infected-devices.md). ## How Alerts and Exposed Data are linked Valid Credentials alerts are built from Exposed Data: Stoïk picks leaked credentials from the feed and tests them against your services. Those that still work are promoted to Alerts. Infected Device alerts work in the other direction: each compromised device typically produces a payload of stolen data (passwords, cookies, browser data) that flows into Exposed Data. Opening an Infected Device alert shows you the associated Exposed Data entries. ## Data refresh frequency Stoïk queries each provider on a regular schedule: * Flare: every 24 hours * Hudson Rock: every 72 hours * LeakCheck: every 7 days Exposed Data and Infected Device alerts follow the same schedule as their respective provider. **Valid Credentials alerts** are tested as soon as new exposed credentials are detected. Stoïk then retests them every 3 days until the credential no longer works, so the alert automatically resolves once the password has been changed. Marking the alert as fixed in Stoïk Protect triggers a new test sooner. ## Alert emails Alert emails are not automatic: the CERT reviews each alert and sends the email by hand, which can take a few days. An alert marked `Waiting on customer` means the email was sent: check your spam folder. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/prevention-tools/credentials.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.