One Afternoon, Five Hundred Keys: Inside a Facilities Firm's Credential Census
Photo: engineers reviewing inventory spreadsheet on laptop in office conference room, via thumbs.dreamstime.com
Every company likes to believe it knows what it owns. The facilities services firm we'll call Meridian Building Solutions — a mid-sized operator headquartered in Columbus, Ohio, with roughly 400 employees and contracts across three states — thought it had a handle on its credentials too. Then a new VP of Engineering asked a simple question during a budget review: how many API keys do we actually have?
Nobody could answer it. Not the platform team, not the vendor managers, not the contractors who had built the original integrations. That question kicked off what the team now calls "the census" — a one-day sprint to inventory every credential the company owned, from cloud provider keys to door badge system tokens to the mapping API credentials buried in a decade-old routing service.
Why the Question Mattered More Than the Answer
Meridian's stack was typical of a growing US services business: a dispatch platform, a fleet tracking vendor, a work-order system, several building access integrations, and a homegrown mapping layer that pulled tiles from two different providers. Each integration had been set up by whoever was on deck at the time. Credentials lived in wiki pages, a shared password manager, the occasional sticky note in a Slack DM, and — in at least one memorable case — a Python file committed to a public repository in 2019.
The risk wasn't theoretical. A former employee's personal AWS account was still billing the company for a Lambda function that synced work orders. A mapping token tied to a departed contractor's email address was handling 60% of the company's geocoding traffic. If that contractor had decided to revoke it, dispatch would have gone dark.
The Inventory Method: Four Hours, One Spreadsheet, Zero New Purchases
Meridian's platform lead, working with two senior engineers, structured the day into four phases.
Phase one: follow the money (90 minutes). The team pulled billing data from their cloud providers and SaaS vendors, looking for line items tied to API usage. Usage-based billing is a surprisingly reliable credential detector — if something is consuming map tiles or geocoding calls, a key somewhere is making it happen.
Phase two: grep the codebase (60 minutes). A simple scan across all repositories for common key patterns — long alphanumeric strings, provider-specific prefixes, environment variable names containing "key," "token," "secret," or "credential" — surfaced dozens of candidates. Open-source secret-scanning tools like Gitleaks and TruffleHog did the heavy lifting here, and both are free.
Phase three: sweep the humans (60 minutes). The team asked every engineering and operations lead the same question: what systems do you touch, and how do you authenticate to them? This produced the credentials that no scanner would ever find — the shared badge-system admin login, the vendor portal account with an API endpoint nobody had documented.
Phase four: reconcile (90 minutes). Every discovered credential went into a single spreadsheet with five columns: what it accesses, who owns it, where it's stored, when it was last rotated, and whether the owner is still employed. That last column did most of the damage.
The Surprises
The census turned up 517 distinct credentials. Of those, 73 belonged to people who had left the company — some more than four years earlier. Eleven keys had never been rotated since creation. Three were duplicates of each other, created by different teams who didn't know the others existed.
Perhaps the most instructive finding: the company's most critical mapping credential had no owner at all. It worked, it was billed somewhere, and no one could say who had created it. That key took two weeks of email archaeology with the vendor to properly reassign.
What Made It Fast
Three choices kept the sprint to a single day. First, the team resisted the urge to fix anything during the census — inventory and remediation are different projects, and mixing them guarantees neither finishes. Second, they used free, open-source tooling: secret scanners for the codebase, the cloud providers' own credential inventories, and a plain spreadsheet rather than a new SaaS purchase that would have required procurement approval and killed momentum. Third, they set a hard deadline. A census with no end date becomes a permanent side project; a census with a 5 p.m. finish becomes a war-room effort.
After the Count
The census didn't solve Meridian's credential hygiene problem, but it converted an invisible risk into a numbered list. Within a month, the 73 orphaned keys were revoked, rotation schedules existed for the credentials that mattered most, and the spreadsheet had been promoted into a tracked inventory reviewed quarterly.
The lesson generalizes beyond facilities companies. If your team cannot produce a complete credential list in a day, that list is being maintained by luck. A one-day census — scanners, billing data, and honest conversations — is the cheapest audit you will ever run, and the ghosts it finds are almost always cheaper to evict now than later.
