What LingerCut is, what it is not, and the steps to inventory → rank → cut → receipt. This guide explains LingerCut. It cannot revoke access, mint kill receipts, or certify that leftover trust is gone. Only a failed-replay or absence probe stamps CUT.
Explains what LingerCut is and the safe steps. Grounded answers only — it cannot cut access or stamp a kill receipt.
Topic index (grounded)
LingerCut is Residual Trust Assurance. After login, password rotation, or a breach of a celebrated vendor (Okta, vault, EDR, SSPM), sessions, OAuth grants, refresh tokens, and API keys often stay alive. LingerCut inventories leftover trust, cuts it out-of-band, then adversarially replays the old credential. A kill receipt is valid only if that replay bounces.
LingerCut is not antivirus, SIEM, EDR, a password manager, an IdP, or an AI-content/deepfake detector. Ranking and this guide are helpers only. They never replace failed-replay proof.
Use this order on a new tenant or after an incident window.
Vendor APIs often return revoked=true while the credential still works. LingerCut does not trust that flag. After cut, an isolated probe tries the old grant/session/token (or re-lists for Workspace/org/IAM absence). Receipt VALID only if the probe fails. WITHHELD means still live — do not tell the board it is gone. With RECEIPT_SIGNING_SECRET, receipts are HMAC-SHA256 signed; verify at /api/receipts/{id}/verify. Signature proves integrity of the receipt bytes — not that the vendor was honest.
False-green cases are demo rows where the vendor would claim revoked while replay still succeeds. Open /false-green or run npm run test:false-green. Every vendorRevokeLies case must WITHHOLD the kill receipt. For authorized live tenants, plant a disposable leftover, cut, and expect WITHHELD only when the credential is still live — never on probeError. See docs/FALSE_GREEN.md.
When DUAL_CONTROL=1 or OPERATOR_PASSWORD_APPROVER is set — or in production/hardening with live connectors configured — high-risk, machine leftover, and live connector cuts queue for a second operator (set DUAL_CONTROL=0 only for lab). Approve at /dual-control with the approver password; approve runs the live connector cut (not demo-only theater). forceExecute is blocked in production; ALLOW_FORCE_EXECUTE=1 is lab-only. See docs/HARDENING.md and docs/DUAL_CONTROL.md.
Primary pilot path: connect GitHub org inventory, load SSO credentials and fine-grained PATs, rank NHI, cut, absence re-list, VALID or WITHHELD, export Evidence Pack. Demo inventory is separate practice. See docs/BEACHHEAD.md.
In production (or LINGERCUT_REQUIRE_HARDENING=1), LingerCut refuses cut/receipt APIs until OPERATOR_PASSWORD, OPERATOR_SESSION_SECRET, and RECEIPT_SIGNING_SECRET are set. OAuth cookies use AES-GCM sealing. Dual-control defaults on with live connectors unless DUAL_CONTROL=0. In-process probe is lab; prefer PROBE_BASE_URL. This is operational fail-closed wiring — not a SOC 2 claim. See docs/HARDENING.md.
When PROBE_BASE_URL is set, cut APIs HTTP-call that host's /api/probe/replay. When unset, probes run in-process — honest lab fallback, not a sovereign isolation claim. Under production/hardening the console warns if the probe is in-process; set LINGERCUT_REQUIRE_ISOLATED_PROBE=1 to refuse cuts without PROBE_BASE_URL. Transport failure returns probeError 503 — never stamps bounce or still_live. Use PROBE_SHARED_SECRET across cut and probe hosts. See docs/PROBE_RELIABILITY.md and docs/HARDENING.md.
Second machine connector after GitHub org NHI. Demo lc_ms_sp_10 always works. Live path: MICROSOFT_SP_LIVE=1 + TENANT_ID + Application.ReadWrite.All — removePassword then adversarial re-get. Okta Admin deferred until Entra SP is solid. See docs/ENTRA_SP_SETUP.md.
AWS wedge cuts leftover IAM user access keys. Demo rows work without keys. Live path needs AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_IAM_TARGET_USER. Receipt requires STS failed-replay or Inactive/absence re-list — see docs/AWS_SETUP.md. Transport failure is probeError, not bounce.
From a playbook, Queue or Run campaign to pack ranked demo cuts and collect receipt summaries under /campaigns. Compliance pack ZIP/JSON is at /api/compliance/export — Fed/SOC-friendly wording: vendor revoke flags are not sole evidence of residual-trust closure.
From an identity, /blast-radius shows related leftover grants (same identity, domain, or related machine trust) across demo inventory. Use it to expand IR scope. Cutting each node still requires failed-replay; the graph is not a receipt.
Demo rows teach the receipt bar without cloud keys. Live boxes use real OAuth grants when connectors are configured in env. Live Google also has Workspace Admin (Directory tokens). Live GitHub has org SSO/PAT inventory for owners. AWS has demo + optional live IAM key cut. Cutting live self-grants revokes LingerCut’s own token — expected.
Two paths: SaaS on https://lingercut.vercel.app (see docs/DEPLOY.md) or sovereign Docker Compose in your VPC (docs/SOVEREIGN_DEPLOY.md). Local: npm run dev on port 4000 with .env.local. Set OAuth/AWS secrets, HTTPS redirect URIs, RECEIPT_SIGNING_SECRET, optional Upstash, OPERATOR_PASSWORD, dual-control, PROBE_ISOLATION_MODE. No default telemetry. CUSTOMER_KMS_KEY_ID is a placeholder for your envelope key. Never put secrets in git — use .env.example as the template.
The ranking helper scores leftover grants (stale, overbroad, false-green, sensitive scopes, playbook hit, machine leftover, blast-radius adjacency, dual-control candidates) so you cut the worst first. Optional LLM narrative needs OPENAI_API_KEY. A high score is not a kill receipt.
Playbooks map leftover surfaces after celebrated-vendor failures, ordinary rotation, and critical-infra contexts (energy OT–IT, defense primes/contractors, finance vendor breach, telecom IdP). Include the DevOps CI playbook for machine identities (GitHub, AWS IAM, Entra service principals). Open a playbook, Run campaign, rank, cut demo or live grants, keep receipts. Defensive residual trust only — not offensive tooling.
Companies seek LingerCut for infrastructure leftover trust: CI deploy bots, fine-grained PATs, org SSO authorizations, AWS IAM access keys, Entra service principals, and stale pipeline identities that survive human MFA and vault rotation. This is not SAST, SCA, CSPM, or a pipeline green badge. Global platform teams use kill receipts to prove machine access is gone.
LingerCut serves commercial CI and critical-infrastructure operators (energy OT–IT bridge leftovers, defense primes/contractors, finance after vendor breach, telecom IdP leftovers). Same defensive bar: cut leftover access and prove it bounced. Not a cyber weapon. Prefer sovereign Docker deploy in your VPC when public SaaS is not allowed — docs/SOVEREIGN_DEPLOY.md and docs/CRITICAL_INFRA.md. No default telemetry; customer KMS placeholder for signing secrets.
Public list pricing is on /pricing. Lab is free (demo leftover-trust practice). Pilot is $599/mo or $6,490/yr (1 org, 1 live connector beachhead — GitHub org NHI recommended — kill receipts, dual-control, evidence ZIP; written as a pilot, not a SOC 2 SLA). Team / IR is $1,990/mo or $19,900/yr (up to 3 live connectors, playbooks/campaigns). Sovereign is $59,900/yr plus $12,500 onboarding (Docker in your VPC; isolated probe required). Meter is organization + connectors + operator seats — not per-employee IdP seats and not per-cut. There is no in-app Stripe charge. hello@lingercut.com is the brand address; mailbox MX is not live yet — paid-plane requests also go through in-app Support. A chat answer is not a contract.
Lab is free: demo inventory cuts (lc_*), operator guide, false-green teaching, and operator lock if you set a password. Lab does not include live Google / Microsoft / GitHub / AWS / Entra cuts as a paid production control, and it has no SLA. Pilot is the default first purchase for design partners: one org, one live connector beachhead, kill receipts, dual-control, evidence ZIP. Isolated probe is not promised on Pilot. Team / IR adds more live connectors and playbook campaigns. Sovereign is for critical infra that cannot run leftover-trust on shared Vercel. Live vs demo on a cut is a separate question: demo rows teach the receipt bar; live boxes need connector env.
This guide and any LLM phrasing cannot: cut grants for you, invent revoke success, issue KR- receipts, store your passwords, declare the environment clean, or provide offensive cyber / exploit capability. LingerCut only helps operators cut and prove leftover trust in systems they authorize. Operators authorize Cut; probes decide the stamp.