@@ -150,6 +150,18 @@ def cmd_validate(_args: argparse.Namespace) -> int:
     return 0
 
 
+def cmd_dependents(args: argparse.Namespace) -> int:
+    """Local, read-only search for what uses a credential (GH#34719)."""
+    import credential_inventory_dependents as dependents
+
+    result = dependents.find_dependents(names.related_names(store.load(), args.name))
+    if args.json:
+        emit_json(result)
+    else:
+        print(dependents.render(result))
+    return 0
+
+
 # --------------------------------------------------------------------------
 # parser
 # --------------------------------------------------------------------------
@@ -211,6 +223,10 @@ def add_simple_parsers(sub: argparse._SubParsersAction) -> None:
     resolve_name = sub.add_parser("resolve-name", help="source credential for an alias or default variable")
     resolve_name.add_argument("name")
     resolve_name.set_defaults(func=cmd_resolve_name)
+    dependents = sub.add_parser("dependents", help="find what uses a credential before rename/rotation")
+    dependents.add_argument("name")
+    dependents.add_argument("--json", action="store_true")
+    dependents.set_defaults(func=cmd_dependents)
 
 
 def build_parser() -> argparse.ArgumentParser:
 
@@ -0,0 +1,159 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2025-2026 Marcus Quinn
+"""What uses a credential? Local, read-only dependents search (GH#34719).
+
+Searches registered repos and their linked worktrees, custom agents, local
+aidevops configs, scheduler definitions and the user crontab for a secret
+name and its aliases. Reads no secret values, makes no network calls, and
+reports `complete: false` whenever coverage is unproven (dynamic name
+construction, timeouts, truncation or unreadable sources), so a result
+never claims "unused" without evidence.
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess  # nosec B404 -- exception classes only; commands run via credential_inventory_scan.run_tool
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+from typing import Any
+
+import credential_inventory_scan as scan
+
+GREP_TIMEOUT = 30
+MAX_WORKERS = 8
+CONFIG_SUFFIXES = {".json", ".conf", ".toml", ".yaml", ".yml"}
+REGISTRY_FILE = "credential-inventory.json"
+
+
+def registered_repos(home: Path) -> list[tuple[str, Path]]:
+    """(label, path) for each existing repo in repos.json."""
+    try:
+        data = json.loads((home / ".config" / "aidevops" / "repos.json").read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return []
+    entries = data.get("initialized_repos", []) if isinstance(data, dict) else []
+    repos = []
+    for entry in entries if isinstance(entries, list) else []:
+        path = Path(str((entry or {}).get("path", ""))).expanduser()
+        if str(path) != "." and path.is_dir():
+            repos.append((str(entry.get("slug") or path.name), path))
+    return repos
+
+
+def worktrees(repo: Path) -> list[Path]:
+    """Existing worktree paths (main checkout included) for a repo."""
+    try:
+        result = scan.run_tool("git", ["-C", str(repo), "worktree", "list", "--porcelain"], GREP_TIMEOUT)
+    except (OSError, subprocess.SubprocessError):
+        return [repo]
+    paths = [Path(line[9:]) for line in result.stdout.splitlines() if line.startswith("worktree ")]
+    return [path for path in paths if path.is_dir()] or [repo]
+
+
+def local_files(home: Path) -> dict[str, list[Path]]:
+    """Config and scheduler files to scan, grouped by source."""
+    config_dir = home / ".config" / "aidevops"
+    configs = sorted(
+        path for path in config_dir.glob("*")
+        if path.is_file() and path.suffix in CONFIG_SUFFIXES and path.name != REGISTRY_FILE
+    ) if config_dir.is_dir() else []
+    schedulers = sorted((home / "Library" / "LaunchAgents").glob("*.plist"))
+    systemd = home / ".config" / "systemd" / "user"
+    schedulers += sorted(path for path in systemd.glob("*") if path.suffix in {".service", ".timer"})
+    return {"config": configs, "scheduler": schedulers}
+
+
+def crontab_hits(needles: scan.Needles) -> tuple[list[dict], str | None]:
+    """Scan `crontab -l`; no crontab is an empty result, not a gap."""
+    try:
+        result = scan.run_tool("crontab", ["-l"], 10)
+    except FileNotFoundError:
+        return [], None
+    except (OSError, subprocess.SubprocessError):
+        return [], "crontab unreadable"
+    if result.returncode != 0:
+        return [], None
+    return [{"path": "crontab", **hit} for hit in scan.scan_lines(result.stdout.splitlines(), needles)], None
+
+
+class Report:
+    """Accumulates hits, skipped sources and coverage counts."""
+
+    def __init__(self, names: list[str]) -> None:
+        self.names = names
+        self.hits: list[dict] = []
+        self.skipped: list[dict] = []
+        self.scanned: dict[str, int] = {}
+
+    def add(self, source: str, location: str, hits: list[dict], reason: str | None = None) -> None:
+        self.hits += [{"source": source, "location": location, **hit} for hit in hits]
+        if reason:
+            self.skipped.append({"source": source, "location": location, "reason": reason})
+        self.scanned[source] = self.scanned.get(source, 0) + 1
+
+    def result(self) -> dict[str, Any]:
+        literal = [hit for hit in self.hits if hit["kind"] == "literal"]
+        dynamic = [hit for hit in self.hits if hit["kind"] == "possible-dynamic"]
+        return {
+            "name": self.names[0],
+            "aliases": self.names[1:],
+            "literal": literal,
+            "possible_dynamic": dynamic,
+            "skipped": self.skipped,
+            "scanned": self.scanned,
+            "complete": not dynamic and not self.skipped,
+        }
+
+
+def scan_repos(report: Report, home: Path, needles: scan.Needles) -> None:
+    """git grep every worktree of every registered repo, in parallel."""
+    targets = [(label, tree) for label, repo in registered_repos(home) for tree in worktrees(repo)]
+    targets = list({str(tree): (label, tree) for label, tree in targets}.values())
+    with ThreadPoolExecutor(max_workers=MAX_WORKERS) as pool:
+        results = pool.map(lambda target: scan.grep_worktree(target[1], needles, GREP_TIMEOUT), targets)
+        for (label, tree), (hits, reason) in zip(targets, results):
+            report.add("repo", str(tree), [{"repo": label, **hit} for hit in hits], reason)
+
+
+def scan_local(report: Report, home: Path, needles: scan.Needles) -> None:
+    """Custom agents, aidevops configs, schedulers and crontab."""
+    custom, capped = scan.tree_files(home / ".aidevops" / "agents" / "custom")
+    groups = {"custom-agents": custom, **local_files(home)}
+    for source, paths in groups.items():
+        hits, skipped = scan.scan_files(paths, needles)
+        report.add(source, source, hits, "file limit reached" if source == "custom-agents" and capped else None)
+        report.scanned[source] = len(paths)
+        for path in skipped:
+            report.skipped.append({"source": source, "location": path, "reason": "unreadable or too large"})
+    hits, reason = crontab_hits(needles)
+    report.add("crontab", "crontab", hits, reason)
+
+
+def find_dependents(names: list[str], home: Path | None = None) -> dict[str, Any]:
+    """Search all local sources for `names` (canonical first, then aliases)."""
+    home = home or Path.home()
+    needles = scan.build_needles(names)
+    report = Report(names)
+    scan_repos(report, home, needles)
+    scan_local(report, home, needles)
+    return report.result()
+
+
+def render(result: dict[str, Any]) -> str:
+    """Human-readable report; never states 'unused' when incomplete."""
+    aliases = f" (aliases: {', '.join(result['aliases'])})" if result["aliases"] else ""
+    lines = [f"Dependents of {result['name']}{aliases}"]
+    for label, key in (("literal", "literal"), ("possible-dynamic", "possible_dynamic")):
+        for hit in result[key]:
+            lines.append(f"  {label:16} {hit['location']}  {hit['path']}:{hit['line']}  [{hit['matched']}]")
+    for skip in result["skipped"]:
+        lines.append(f"  skipped          {skip['location']}  ({skip['reason']})")
+    scanned = ", ".join(f"{source} {count}" for source, count in sorted(result["scanned"].items()))
+    lines.append(f"Scanned: {scanned}")
+    if not result["complete"]:
+        lines.append("INCOMPLETE: dynamic name construction or skipped sources; do not treat this name as unused.")
+    elif not result["literal"]:
+        lines.append("No references found in the scanned sources.")
+    return "\n".join(lines)
@@ -72,6 +72,14 @@ def alias_owner(data: dict[str, Any], alias: str) -> str | None:
     return None
 
 
+def related_names(data: dict[str, Any], name: str) -> list[str]:
+    """Canonical name first, then its declared aliases (works from an alias too)."""
+    check_name("secret name", name)
+    canonical = alias_owner(data, name) or name
+    record = (data.get("credentials") or {}).get(canonical) or {}
+    return [canonical, *sorted(set(record.get("aliases") or []) - {canonical})]
+
+
 def add_alias(data: dict[str, Any], name: str, alias: str) -> None:
     """Declare `alias` as another name for recorded credential `name`."""
     check_name("secret name", name)
 
@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: 2025-2026 Marcus Quinn
+"""Bounded reference scanning for credential names (GH#34719).
+
+Classifies lines as a literal use of a secret name (token-exact) or a
+possible dynamic construction (`PREFIX_${X}_TAIL`, concatenation, f-strings,
+`%s`/`.format`). Matched line text is used only for classification and is
+never returned, so values that happen to sit in scanned files never leak.
+"""
+
+from __future__ import annotations
+
+import os
+import plistlib
+import re
+import shutil
+import subprocess  # nosec B404 -- absolute git/crontab, list argv, never a shell
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Iterable
+from xml.parsers.expat import ExpatError
+
+MAX_HITS = 500
+MAX_FILE_BYTES = 1_000_000
+MAX_TREE_FILES = 5000
+MAX_GAP = 80
+TOKEN_RE = re.compile(r"[A-Za-z0-9_]")
+DYNAMIC_RE = re.compile(r"\$\{|\$\(|\$[A-Za-z_]|[\"']\s*\+|\+\s*[\"']|%s|\{[A-Za-z_][\w.]*\}|\.format\(|\.join\(")
+SKIP_DIRS = {".git", "node_modules", "__pycache__", ".venv", "venv"}
+
+
+@dataclass(frozen=True)
+class Needles:
+    """Exact names plus (prefix, tail) stems for dynamic-construction checks."""
+
+    names: tuple[str, ...]
+    stems: tuple[tuple[str, str], ...]
+
+    @property
+    def patterns(self) -> list[str]:
+        """Fixed strings for a first-pass grep; every name contains its prefix."""
+        return sorted({prefix for prefix, _ in self.stems} | set(self.names))
+
+
+def build_needles(names: Iterable[str]) -> Needles:
+    """Build needles from a secret name and its aliases."""
+    unique = sorted(set(names))
+    stems = {(parts[0], parts[-1]) for parts in (name.split("_") for name in unique) if len(parts) >= 2}
+    return Needles(tuple(unique), tuple(sorted(stems)))
+
+
+def has_token(line: str, name: str) -> bool:
+    """True when `name` appears with no identifier characters either side."""
+    start = line.find(name)
+    while start >= 0:
+        end = start + len(name)
+        before = line[start - 1] if start else ""
+        after = line[end] if end < len(line) else ""
+        if not TOKEN_RE.match(before) and not TOKEN_RE.match(after):
+            return True
+        start = line.find(name, start + 1)
+    return False
+
+
+def looks_dynamic(line: str, prefix: str, tail: str) -> bool:
+    """True when prefix..tail on one expression is joined by a dynamic part."""
+    start = line.find(prefix)
+    while start >= 0:
+        gap_start = start + len(prefix)
+        end = line.find(tail, gap_start)
+        gap = line[gap_start:end] if end >= 0 else ""
+        if 0 < len(gap) <= MAX_GAP and prefix not in gap and not set(gap) & {";", "="} and DYNAMIC_RE.search(gap):
+            return True
+        start = line.find(prefix, start + 1)
+    return False
+
+
+def classify(line: str, needles: Needles) -> tuple[str, str] | None:
+    """Return ("literal", NAME), ("possible-dynamic", PATTERN) or None."""
+    for name in needles.names:
+        if has_token(line, name):
+            return "literal", name
+    for prefix, tail in needles.stems:
+        if looks_dynamic(line, prefix, tail):
+            return "possible-dynamic", f"{prefix}_*_{tail}"
+    return None
+
+
+def scan_lines(lines: Iterable[str], needles: Needles) -> list[dict]:
+    """Classify numbered lines; returns path-less hit records."""
+    hits = []
+    for number, line in enumerate(lines, 1):
+        hit = classify(line, needles)
+        if hit:
+            hits.append({"line": number, "kind": hit[0], "matched": hit[1]})
+    return hits
+
+
+def run_tool(tool: str, args: list[str], timeout: int) -> subprocess.CompletedProcess:
+    """Run a fixed system tool by absolute path; FileNotFoundError if absent."""
+    executable = shutil.which(tool)
+    if not executable:
+        raise FileNotFoundError(tool)
+    # Absolute executable, list argv (no shell); args are paths and fixed-string needles.
+    return subprocess.run(  # nosec B603
+        [executable, *args], capture_output=True, text=True, errors="replace", timeout=timeout, check=False,
+    )
+
+
+def grep_worktree(path: Path, needles: Needles, timeout: int) -> tuple[list[dict], str | None]:
+    """git grep a worktree (tracked + untracked, honouring .gitignore)."""
+    args = ["-C", str(path), "grep", "-I", "-n", "--null", "--untracked", "-F"]
+    for pattern in needles.patterns:
+        args += ["-e", pattern]
+    try:
+        result = run_tool("git", args, timeout)
+    except subprocess.TimeoutExpired:
+        return [], "timeout"
+    except OSError:
+        return [], "git unavailable"
+    if result.returncode not in (0, 1):
+        return [], "git grep failed"
+    hits: list[dict] = []
+    for raw in result.stdout.splitlines():
+        parts = raw.split("\0", 2)
+        hit = classify(parts[2], needles) if len(parts) == 3 and parts[1].isdigit() else None
+        if hit:
+            hits.append({"path": parts[0], "line": int(parts[1]), "kind": hit[0], "matched": hit[1]})
+        if len(hits) >= MAX_HITS:
+            return hits, "truncated"
+    return hits, None
+
+
+def plist_as_xml(data: bytes) -> str | None:
+    """XML text for a parseable plist, or None so callers fall back to raw text."""
+    try:
+        return plistlib.dumps(plistlib.loads(data), fmt=plistlib.FMT_XML).decode("utf-8", "replace")
+    except (plistlib.InvalidFileException, ExpatError, ValueError, TypeError, OverflowError):
+        return None
+
+
+def read_text(path: Path) -> str | None:
+    """Readable text (XML for binary plists); "" for binary, None if unscanned."""
+    try:
+        if path.stat().st_size > MAX_FILE_BYTES:
+            return None
+        data = path.read_bytes()
+    except OSError:
+        return None
+    if path.suffix == ".plist":
+        xml_text = plist_as_xml(data)
+        if xml_text is not None:
+            return xml_text
+    if b"\0" in data[:4096]:
+        return ""  # binary, skipped like `git grep -I`
+    return data.decode("utf-8", "replace")
+
+
+def scan_files(paths: Iterable[Path], needles: Needles) -> tuple[list[dict], list[str]]:
+    """Scan explicit files; returns hits and paths skipped as unreadable/large."""
+    hits: list[dict] = []
+    skipped: list[str] = []
+    for path in paths:
+        text = read_text(path)
+        if text is None:
+            skipped.append(str(path))
+            continue
+        hits += [{"path": str(path), **hit} for hit in scan_lines(text.splitlines(), needles)]
+    return hits, skipped
+
+
+def tree_files(root: Path) -> tuple[list[Path], bool]:
+    """Files under root (skipping VCS/dependency dirs); True if capped."""
+    found: list[Path] = []
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [name for name in dirnames if name not in SKIP_DIRS]
+        found += [Path(dirpath) / name for name in filenames]
+        if len(found) >= MAX_TREE_FILES:
+            return found[:MAX_TREE_FILES], True
+    return found, False