> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/prevention-tools/credentials/valid-credentials.md). # Valid Credentials A Valid Credentials alert means Stoïk found a leaked URL + login + password in [Exposed Data](/prevention-tools/credentials/exposed-data.md) and **confirmed it still grants access** to one of your services today (Microsoft 365, Fortinet VPN, Citrix, exposed web panels, and others). This is not a historical leak. It is a working credential that an attacker could use right now. ## How Stoïk tests a password Stoïk makes one automated login attempt, chosen from where the password leaked: Microsoft 365, a Fortinet VPN, a Citrix gateway, or the website in the leak (a browser agent fills in the login form). Each alert shows the method. Stoïk never browses inside the account. The tests come from an AWS IP range located in Ireland, with no fixed IP, like the [External Scan](/prevention-tools/external-scan.md). Sign-ins from Ireland on leaked accounts in your logs are probably Stoïk's. If you need the exact time and IP of the attempts, contact . ## Resolving an alert 1. Reset the password for the affected account immediately. 2. Enable multi-factor authentication (MFA) on that account if not already active. 3. Check whether the same password is reused on other services. Change those too. 4. Mark the alert as fixed once done. This triggers a new test sooner: otherwise, Stoïk retests every 3 days. Stoïk does not share the leaked password. See [Leaked password](/prevention-tools/credentials/leaked-password.md) for the reasons and for what to do when the employee is gone. ## Troubleshooting
MFA is enabled, so why is there an alert? Stoïk raises the alert as soon as the service accepts the password, even if MFA comes next. The password is still compromised and only MFA protects the account: the fix is still a reset.
I reset the password, but the alert is still there Stoïk retests every 3 days while the password still works. Marking the alert as fixed triggers a new test sooner. Then check the last tested date on the alert: * **After the reset, and still valid:** the reset didn't reach the account Stoïk tests. It is often another account with the same email (another tenant, a third-party or personal account). Don't mark it as a false positive. * **Weeks old:** the retest may be stuck. Contact .
The account doesn't exist The alert shows where Stoïk tested the password and how. It is often an account the employee created with their work email outside your company's systems, for example a personal Tableau ID instead of the company's Tableau Cloud site. Your admin console doesn't show it, but the password works there. The answer is the same: a reset through the email address, as described in [Leaked password](/prevention-tools/credentials/leaked-password.md). If the tested URL looks like a signup page, or you think the test is wrong, contact with the alert link.
Why was an alert archived? A retest found that the password no longer works, or the service (a VPN, for example) has been unreachable for a week. Stoïk Protect doesn't show the reason or the test history yet.
The Exclude button is greyed out While the alert is in `CERT Analysis`, you can only make a discard request from the side panel. A password that still works is not a false positive, even if the employee has left.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/prevention-tools/credentials/valid-credentials.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.