GitGuardian SaaS

No entries match these filters. Clear filters

1. announced Nov 2, 2026 · issue 130

   GitGuardian adds a Wiz integration to sync open secret incidents from version control into Wiz as native secret findings once a day⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Connect GitGuardian to Wiz so your cloud security team sees leaked secrets alongside cloud risk without leaving their tool.
   📍In Wiz, open the GitGuardian integration page and copy the Client ID, Client secret, Authentication URL, and API endpoint URL. In GitGuardian, go to Settings › Integrations › Wiz, click Configure, paste the four values, choose how to map Info and Unknown severities to Wiz severities, and click Add integration. Findings appear in Wiz within 24 hours.
   • Configure the Wiz integration in GitGuardian at Settings > Integrations > Wiz by pasting the Client ID, Client secret, Authentication URL, and API endpoint URL that Wiz provides, then map Info and Unknown severities to Wiz equivalents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • GitGuardian now syncs open secret incidents daily from GitHub, GitLab, Bitbucket, and Azure DevOps into Wiz as native secret findings, each carrying repository, file path, commit, detector, validity status, severity, and a link back to the GitGuardian incident.
   • Secret values never leave GitGuardian — Wiz receives only a SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash of the value plus metadata.
   • Validity context is included in each Wiz finding so that live, still-working keys are surfaced ahead of inactive ones.
   • Pausing or resuming the daily sync is available from the same Settings > Integrations > Wiz settings page at any time.

   5 details in Everything

2. api-docs-dbcff7cc4c0f Oct 30, 2026 · issue 125

   GitGuardian adds API endpoints to retrieve occurrence content in clear text, manage NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. policies, and trigger on-demand secret validity checks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Pull the exact diff content of a triaged occurrence — including where the secret sits — so you can pipe it into a remediation script without opening the dashboard.
   copy

   $ curl -H 'Authorization: Token <PAT>' \
     https://api.gitguardian.com/v1/occurrences/secrets/<occurrence_id>/content

   Switch an NHI policy from tagging-only to full incident creation so breaches start appearing in your incident queue once NHI promotion is active.
   copy

   $ curl -X PATCH \
     -H 'Authorization: Token <PAT>' \
     -H 'Content-Type: application/json' \
     -d '{"incident_mode": "creates_incidents"}' \
     https://api.gitguardian.com/v1/nhi/policies/<policy_name>

   • Retrieve the clear-text content of a private secret occurrence, including secret match positions, via GET /v1/occurrences/secrets/{occurrence_id}/content — requires a PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (service account tokens are refused) and the workspace setting 'Enable API endpoints to retrieve detected secrets and occurrence content in clear text' plus IP allowlist on SaaS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • List all NHI policies and their current incident_mode values (hidden, tag_only, or creates_incidents) via GET /v1/nhi/policies — requires full NHI governance activation.
   • Retrieve a single NHI policy and its incident_mode and is_incident_mode_fixed fields via GET /v1/nhi/policies/{policy_name}.
   • Trigger an on-demand secret validity check via POST /v1/secrets/{secret_id}/validity/check; poll last_checked_at afterward to confirm the refreshed result — checks are rate-limited to one per secret per 5 minutes and skipped for secrets with a validity override or that GitGuardian cannot check.

   4 details in Everything

3. changelog Oct 29, 2026 · issue 124

   GitGuardian adds Docker Hub public monitoring, a --background scan mode, and a local machine dashboard with Codex and opencode redaction⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ TRY IT
   Add to a scheduled MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. scan command so the scan runs at low priority without slowing developer machines.
   copy

   $ ggshield machine report --background

   Make low-priority background mode the default for all machine scans fleet-wide, so no per-command flag is needed.
   machine_scan.yaml copy

   scan:
     resources:
       background:
         mode: auto

   Open the local dashboard overview to start triaging and redacting secrets by AI agent or repository.
   copy

   $ ggshield machine dashboard

   • Open a cleanup overview with ggshield machine dashboard, which now lands on an Overview page grouping findings by AI agents, repositories, and history and logs.
   • Docker Hub incidents now carry publishing account, image, repository, and layer context, and flow through the same notifications, integrations, and agents analysis as GitHub incidents.
   • Findings pushed to Wiz now include GitGuardian incident, occurrence, and source IDs in the finding's originalObject field for use in Wiz workflows and the Wiz API.
   • Honeytoken planting is now supported on Windows endpoints.
   • Scans now skip additional folders of downloaded or generated files, including pip-*, pytest-of-*, and _MEI* temp leftovers, NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. and Scoop package caches, and Electron app caches.
   • Docker Hub incidents now carry publishing account, image, repository, and layer context, and flow through the same notifications, integrations, and agents analysis as GitHub incidents.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Validity checks no longer read custom hosts from environment variables or local config files; custom hosts are now sourced exclusively from your GitGuardian workspace.
4. Sync your GitHub teams, members, and perimeters automatically (2026-10-29) Oct 29, 2026 · issue 125

   GitGuardian adds automatic GitHub team sync, multi-header custom webhooks, new Public API endpoints, and scoped Endpoint Protection auth⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   Trigger or review GitHub team sync after enabling it, to immediately mirror your GitHub org's teams and members without waiting for the 24-hour cycle.
   📍Open your GitHub integration settings, scroll to Team synchronization, click Add organization, select the organization to mirror, then click Sync now to run an immediate sync and view results in the synchronization history.
   • Add a custom webhook integration that now accepts multiple custom headers (such as bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. or routing headers) per webhook, configured from its settings page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Unlink a ticket from an incident using a new Public API endpoint.
   • Retrieve the stored content of an occurrence of an internal or public incident in clear text via new Public API endpoints, subject to the same requirements as secret access.
   • Scope Endpoint Protection permissions more narrowly: the ggshield auth login authorization page now groups Endpoint Protection scopes in a single opt-in card, no longer granted by default.
   • GitGuardian adds GitHub team sync: enable team synchronization on your GitHub integration and GitGuardian mirrors your GitHub organization's teams, members, and repository ownership into your workspace, running every 24 hours or on demand via Sync now.

   +1 more show less

   • GitGuardian Bridge now routes validity checks and secret analysis for detectors where the host is read from the secret itself (such as database connection strings), whenever that host is mapped to a bridge — previously limited to detectors with a custom host configured.
   • Add a custom webhook integration that now accepts multiple custom headers (such as bearer tokensbearer tokensA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. or routing headers) per webhook, configured from its settings page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Unlink a ticket from an incident using a new Public API endpoint.
   • Retrieve the stored content of an occurrence of an internal or public incident in clear text via new Public API endpoints, subject to the same requirements as secret access.
   • GitGuardian adds GitHub team sync: enable team synchronization on your GitHub integration and GitGuardian mirrors your GitHub organization's teams, members, and repository ownership into your workspace, running every 24 hours or on demand via Sync now.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Endpoint Protection scopes are no longer granted by default during ggshield auth login — users must explicitly opt in via the new single card, so existing automation that relied on those scopes being pre-selected will need to re-authenticate.
5. Scan developer machines with less noise, and clean up what you find (2026-10-27) Oct 27, 2026 · issue 123

   GitGuardian Endpoint Protection gains background scanning, an Overview dashboard, Codex/opencode redaction, and validity checks for 501 secret types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Run a scheduled daily inventory scan at low priority so developer machines stay responsive during the MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. job.
   copy

   $ ggshield machine report --background

   Make background-priority scanning the permanent default so every scan — however triggered — leaves the machine responsive.
   machine_scan.yaml copy

   scan:
     resources:
       background:
         mode: auto

   Open the local remediation dashboard to see the Overview and start cleaning up findings grouped by AI agent or repository.
   copy

   $ ggshield machine dashboard

   • Adds --background flag to ggshield machine scan and ggshield machine report to run scans at low priority using 2–4 threads and one-tenth of normal memory (minimum 512 MB), suited for scheduled MDM jobs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds scan.resources.background.mode: auto to machine_scan.yaml to make background-priority scanning the default for every scan.
   • Adds an Overview page to ggshield machine dashboard that lists one row per cleanup area (AI agents, repositories, history and logs) and guides remediation order: overprivileged secrets first, then history leaks, then secrets in daily use.
   • Enables redaction of Codex and opencode history from the local dashboard, including their SQLite history databases.
   • Expands validity checks to 501 secret types (up from 432), adding coverage for Elastic, Datadog, Langfuse, Sumo Logic, Gitea, and Azure Container Registry.

   +2 more show less

   • Suppresses findings from VS Code, Cursor, VSCodium, Windsurf, and JetBrains IDE editor-history copies unless the secret in them is valid, reducing duplicate noise.
   • Expands folder exclusions to skip build leftovers (pip-*, pytest-of-*, _MEI*), Windows package caches (NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code., Scoop), and Electron app caches, while still scanning credential-holding folders.
   • Adds --background flag to ggshield machine scan and ggshield machine report to run scans at low priority using 2–4 threads and one-tenth of normal memory (minimum 512 MB), suited for scheduled MDM jobs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds scan.resources.background.mode: auto to machine_scan.yaml to make background-priority scanning the default for every scan.
   • Adds an Overview page to ggshield machine dashboard that lists one row per cleanup area (AI agents, repositories, history and logs) and guides remediation order: overprivileged secrets first, then history leaks, then secrets in daily use.
   • Enables redaction of Codex and opencode history from the local dashboard, including their SQLite history databases.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Validity checks now take custom hosts only from your GitGuardian workspace; environment variables and local config files that previously set custom hosts are no longer read.
6. api-docs-cce17ae86794 Oct 23, 2026 · issue 118

   GitGuardian adds NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. Identity and Source APIs plus ticket-unlinking endpoint for secrets and honeytokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Unlink a stale Jira ticket from a secret incident after it was closed on the Jira side, without touching the Jira ticket itself.
   copy

   $ curl -X DELETE 'https://api.gitguardian.com/v1/incidents/secrets/8821/destination-tickets/PROJ-42?resource_type=secret-incidents' \
     -H 'Authorization: Token <your_api_token>'

   List all NHIsNHIsA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. in production that breach the long_lived_secret policy and carry critical risk, to prioritise remediation.
   copy

   $ curl -G 'https://api.gitguardian.com/v1/nhi/identities' \
     -H 'Authorization: Token <your_api_token>' \
     --data-urlencode 'env__in=production' \
     --data-urlencode 'policy__in=long_lived_secret' \
     --data-urlencode 'risk_criticality__in=critical'

   Retrieve all locations where a specific NHI holds a secret — useful for tracing blast radius before rotating credentials.
   copy

   $ curl 'https://api.gitguardian.com/v1/nhi/identities/arn%3Aaws%3Aiam%3A%3A123456789012%3Auser%2Fci-deployer/locations' \
     -H 'Authorization: Token <your_api_token>'

   • Adds DELETE /v1/incidents/secrets/{resource_id}/destination-tickets/{ticket_id} to unlink a Jira or ServiceNow ticket from a secret incident, public secret incident, or honeytoken without deleting the ticket on the external platform; uses resource_type query parameter to select the resource kind.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds GET /v1/nhi/identities to list non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. (NHIs) in the workspace, with filters including source__in, env__in, policy__in, risk_criticality__in, validity__in, principal_type__in, owner_id__in, vault_source_id__in, consumer_source_id__in, endpoint_source_id__in, provider_source_id__in, detector_group_name__in, detector_type__in, secret_family__in, secret_category__in, secret_provider__in, has_owner, has_detector, is_admin, and hmsl_hash.
   • Adds GET /v1/nhi/identities/{identity_id} to retrieve a single non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. with its permissions and a summary of its secrets.
   • Adds GET /v1/nhi/identities/{identity_id}/locations to list all locations holding a secret of a non-human identity — secrets manager paths, consumer resources (Kubernetes, CI), endpoints, and provider accounts; requires full NHI governance on the workspace.
   • Adds GET /v1/nhi/sources to list sources sending NHI data to GitGuardian (secrets managers, Kubernetes clusters, CI systems, cloud providers, endpoints), filterable by type, is_vault, and full_path.

   +1 more show less

   • Adds full_path query parameter to NHI Sources endpoint for exact, case-sensitive source lookup, preferred over free-text search for single-source retrieval.

   6 details in Everything

7. docs update Oct 22, 2026 · issue 116

   GitGuardian SaaS: Adds GET /v1/check-runs to list check runs by incident and retrieve their IDs.

   ⤢ ⤢
   └──▷ TRY IT
   Skip a blocking GitHub check run from CI/CD or an incident-response script when the skip buttons are disabled in the UI.
   copy

   $ curl -X POST https://api.gitguardian.com/v1/check-runs/{check_run_id}/skip \
     -H 'Authorization: Token <your_api_token>' \
     -H 'Content-Type: application/json' \
     -d '{"reason": "<skip_reason>"}'

   Retrieve all check runs for a specific incident to get the IDs needed for programmatic skip operations.
   copy

   $ curl -X GET 'https://api.gitguardian.com/v1/check-runs?incident_id=<incident_id>' \
     -H 'Authorization: Token <your_api_token>'

   • Adds Docker Hub monitoring to GitGuardian Public Monitoring, checking newly published public images daily against your perimeter and surfacing leaked secrets as incidents with publishing account, image repository, and layer context.

   1 detail in Everything

8. docs update Oct 22, 2026 · issue 116
   • New detection Lago API Key detector
   • New detection Composio API Key detector
   • New detection Composio Organization API Key detector
   • New detection Codex API Key detector
   • New detection CARTO Basemaps API Key detector
   • New detection Google Chat Webhook URL detector
   • New detection SFTP Credentials detector
   • New detection HubSpot Personal Access Key detector
   • New detection AmneziaWG Private Key detector
   • New detection Kubernetes Kubeconfig Bearer Token detector
   • New detection GoCardless API access token analyzer
   • New detection Adobe refresh token analyzer
   • Updated detection SMTP credentials validity checker enabled
   • Updated detection FTP credentials checker handles secrets without a port
   • Updated detection Algolia monitoring checker extended to all keys with elevated permissions
   • Updated detection Snowflake checker supports short account identifiers, hostnames and full URLs
   • Updated detection Azure Entra app secret detection extended to Microsoft national cloud sign-in hosts
   • Updated detection Azure Entra Access Token checker supports custom host
   • Updated detection Azure Entra ID token checker supports proxy to custom hosts
   • Updated detection Azure Active Directory API Keys checker supports custom host
   • Updated detection GitHub Server-to-server Token detection extended to longer tokens with any scope count
   • Updated detection Docker credentials detector updated to support new format
   • Updated detection SSH password detector extended to expect scripts
   • Updated detection MSSQL assignment detector extended to credentials without a port
   • Updated detection AWS SES Keys checker gains timeout
   • Updated detection GitLab Deploy Token checker supports proxy to custom hosts
   • Updated detection LiteLLM API key checker supports proxy to custom hosts
   • Updated detection Snyk checker extended to SNYK-US-02 region
   • Updated detection n8n API key and MCP access token checkers support hosts without scheme
   • Updated detection Gemfury detectors extended to credentials outside Gemfury repository URLs
   • Retired detection line_notify_token detector removed
   • Updated detection Postgres port-variant detectors merged into postgres_assignment
   • Updated detection Azure Event Grid with-host detector merged into base detector
   • Updated detection Grafana service account with-host detector merged into base detector
   • Updated detection Kubernetes JWT with-host detector merged into base detector
   • Updated detection PlanetScale with-host detector merged into base detector
   └──▷ BREAKING ON UPGRADE

   • !The line_notify_token detector has been removed.
   • !The ftp_credentials_assignment detector now only captures FTP secrets, not SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. — existing SFTP detections move to sftp_credentials_assignment.
   • !The postgres_assignment_attached_port and postgres_assignment_no_port detectors are merged into postgres_assignment; any references to the old detector names will no longer match.
   • !The azure_event_grid_access_key_with_host detector is merged into azure_event_grid_access_key; references to the old name will no longer match.
   • !The grafana_service_account_token_with_host detector is merged into grafana_service_account_token; references to the old name will no longer match.
   • !The kubernetes_jwt_with_host detector is merged into kubernetes_jwt; references to the old name will no longer match.
   • !The planetscale_database_password_with_host_and_username detector is merged into planetscale_database_password; references to the old name will no longer match.
9. Catch secrets leaked in public Docker Hub images (2026-10-21) Oct 21, 2026 · issue 116

   GitGuardian Public Monitoring now scans newly published Docker Hub images daily, matching secrets to your perimeter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Surfaces Docker Hub-specific context on every incident — publishing account, image and repository name, and the layer the secret was found in — instead of commit and author.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Routes Docker Hub incidents through existing notifications, integrations, and agents analysis, matching the workflow for GitHub incidents.
   • Enriches findings pushed to Wiz with GitGuardian incident, occurrence, and source IDs in the finding's originalObject field, enabling use in Wiz workflows and via the Wiz API.
   • Extends Honeytoken planting support to Windows endpoints.
   • Surfaces Docker Hub-specific context on every incident — publishing account, image and repository name, and the layer the secret was found in — instead of commit and author.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

10. api-docs-6756f12bc87c Oct 20, 2026 · issue 114

    GitGuardian adds API endpoints to list and skip GitHub Check Runs that block pull requests⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Find all blocking check runs tied to a known secret incident so you can review before unblocking a PR.
    copy

    $ curl -s -H 'Authorization: Token <manager-token>' 'https://api.gitguardian.com/v1/check-runs?incident_id=3759'

    Programmatically skip a blocking check run marked as a false positive, so the PR can merge even when workspace Skip buttons are disabled.
    copy

    $ curl -s -X POST -H 'Authorization: Token <manager-token>' -H 'Content-Type: application/json' -d '{"reason": "false_positive"}' 'https://api.gitguardian.com/v1/check-runs/42/skip'

    • Adds GET /v1/check-runs endpoint to list GitHub check runs GitGuardian ran on pull requests, filterable by incident_id to surface runs that reported a specific secret incident.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST /v1/check-runs/{check_run_id}/skip endpoint to programmatically skip a blocking GitHub check run, tagging its incidents and occurrences with CHECK_RUN_SKIP_* and logging activity — even when the Skip buttons are disabled in workspace settings.
    • Exposes check run response fields including repository_full_name, commit_sha, pull_requests, github_status, github_conclusion, head_branch, and base_branch for rich filtering and automation.

    3 details in Everything

11. changelog Oct 20, 2026 · issue 114

    ggscout 0.34.1 adds in-network validity checks and permissions analysis for vaulted secrets, plus a new POST /v1/check-runs/{check_run_id}/skip API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ USE IT
    Opt out of validity and permissions checks on a specific ggscout deployment where outbound provider calls are not permitted.
    ini copy

    [check]
    enabled = false

    • Adds in-network validity checks and permissions analysis to ggscout (requires v0.34.1 or later), running after classification and before hashing so internal vaults, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.-gated databases, and provider-restricted endpoints are reachable without allowlisting GitGuardian IPs, with a new [check] enabled = false config key to opt out of these checks per deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Surfaces validity results in the NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. inventory as a Validity column and filter with Valid and Invalid values, exposes token permission scopes (e.g. repo, admin:org on GitHub; api on GitLab) per credential in the NHI identity detail, adds owner account, expiry date, and provider metadata to NHI identity detail via ggscout, and merges validity verdicts from vaulted or Kubernetes secrets with any matching secret incident, keeping the most recent verdict across both surfaces.
    • Adds a built-in Valid saved view to the Endpoint Protection discovered secrets page, listing all secrets currently checked as valid.
    • On-demand Jira Cloud scans launched from the dashboard or the public API now queue ahead of recurrent and system scans; public API launches using a service account token on AWS S3 and version control sources now count as on-demand scans.
    • GitGuardian plans are renamed to Free (Starter), Growth, and Enterprise, and the Plan and usage page now compares features per plan grouped as on the pricing page.
    • Adds in-network validity checks and permissions analysis to ggscout (requires v0.34.1 or later), running after classification and before hashing so internal vaults, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection.-gated databases, and provider-restricted endpoints are reachable without allowlisting GitGuardian IPs, with a new [check] enabled = false config key to opt out of these checks per deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Surfaces validity results in the NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. inventory as a Validity column and filter with Valid and Invalid values, exposes token permission scopes (e.g. repo, admin:org on GitHub; api on GitLab) per credential in the NHI identity detail, adds owner account, expiry date, and provider metadata to NHI identity detail via ggscout, and merges validity verdicts from vaulted or Kubernetes secrets with any matching secret incident, keeping the most recent verdict across both surfaces.
    • Adds a built-in Valid saved view to the Endpoint Protection discovered secrets page, listing all secrets currently checked as valid.

    2 more in Everything

12. api-docs-5b2c2350cba5 Oct 16, 2026 · issue 110

    GitGuardian adds NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. identity owner management endpoints for reading and updating ownership of non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    List all owners of a non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. to audit accountability for a service account or API key.
    copy

    $ curl -s -H 'Authorization: Token <api_key>' 'https://api.gitguardian.com/v1/nhi/identities/{identity_id}/owners'

    Assign an owner to a non-human identity so the responsible team member is tracked for remediation workflows.
    copy

    $ curl -s -X POST -H 'Authorization: Token <api_key>' -H 'Content-Type: application/json' -d '{"owner_id": "<owner_id>"}' 'https://api.gitguardian.com/v1/nhi/identities/{identity_id}/owners'

    Remove a former owner from a non-human identity when team membership changes.
    copy

    $ curl -s -X DELETE -H 'Authorization: Token <api_key>' 'https://api.gitguardian.com/v1/nhi/identities/{identity_id}/owners/{owner_id}'

    • Adds GET /v1/nhi/identities/{identity_id}/owners endpoint to list owners of a non-human identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST /v1/nhi/identities/{identity_id}/owners endpoint to assign owners to a non-human identity.
    • Adds POST /v1/nhi/identities/{identity_id}/owners/update endpoint to update ownership records for a non-human identity.
    • Adds GET /v1/nhi/identities/{identity_id}/owners/{owner_id} endpoint to retrieve a specific owner of a non-human identity.
    • Adds DELETE /v1/nhi/identities/{identity_id}/owners/{owner_id} endpoint to remove a specific owner from a non-human identity.

    5 details in Everything

13. Check validity and permissions of your vaulted secrets, from inside your network (2026-10-15) Oct 15, 2026 · issue 110

    ggscout 0.34.1 checks validity and permissions of vaulted secrets in-network, surfacing live verdicts in the NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. inventory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Disable in-network validity checks for a specific ggscout deployment that cannot reach external providers.
    ini copy

    [check]
    enabled = false

    After upgrading to ggscout 0.34.1, run a fetch-and-send to populate validity verdicts, then filter the NHI inventory to immediately see all invalid credentials still sitting in vaults or Kubernetes clusters.
    📍In NHI Governance → Identities, open the Validity filter and select Invalid to list revoked credentials across vaults, CI variables, and Kubernetes clusters.
    • Adds [check] enabled = false config key to opt out of in-network validity and permissions checks per ggscout deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Validity column and filter (Valid, Invalid, Unknown) for all secrets collected by ggscout, surfaces token permission scopes (e.g. repo, admin:org on GitHub; api on GitLab) alongside each identity, and reports credential owner, expiry date, and provider metadata in the identity detail view, sourced directly from the provider during each ggscout run, in the NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. → Identities inventory.
    • Merges validity verdicts from vaulted or Kubernetes secrets with any matching secret incident, always keeping the most recent verdict.
    • Adds a built-in Valid saved view on the Endpoint Protection discovered secrets page, available to all users.
    • Documents all API token permissions in the public API documentation, including eleven previously granted but undocumented permissions.

    +1 more show less

    • Adds on-demand priority queuing for Jira Cloud historical scans launched from the dashboard or public API so they start ahead of recurrent and system scans, and counts public API historical scan launches made with a service account token as on-demand on AWS S3 and version control sources.
    • Adds [check] enabled = false config key to opt out of in-network validity and permissions checks per ggscout deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Validity column and filter (Valid, Invalid, Unknown) for all secrets collected by ggscout, surfaces token permission scopes (e.g. repo, admin:org on GitHub; api on GitLab) alongside each identity, and reports credential owner, expiry date, and provider metadata in the identity detail view, sourced directly from the provider during each ggscout run, in the NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. → Identities inventory.
    • Merges validity verdicts from vaulted or Kubernetes secrets with any matching secret incident, always keeping the most recent verdict.
    • Adds a built-in Valid saved view on the Endpoint Protection discovered secrets page, available to all users.

    2 more in Everything

14. docs update Oct 9, 2026 · issue 099

    GitGuardian adds Harbor registry scanning, per-secret environment classification, PR comment notes, and a new presence-check API endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ TRY IT
    Trigger an on-demand presence check for a specific secret incident without waiting for the next scheduled scan.
    copy

    $ curl -X POST 'https://api.gitguardian.com/v1/incidents/secrets/42/check-presence' \
      -H 'Authorization: Token <your-api-token>'

    Filter the incidents API to only surface incidents where ALL sources are deleted or archived, reducing noise from partially-removed code.
    copy

    $ curl -G 'https://api.gitguardian.com/v1/incidents' \
      -H 'Authorization: Token <your-api-token>' \
      --data-urlencode 'source_monitoring_status__all=deleted,archived'

    Set up Harbor integration via the GitGuardian dashboard to begin scanning all image layers in a self-hosted registry for secrets.
    📍1. In Harbor, create a system-level robot account with Repository (List, Pull) and Artifact (List, Read) permissions. 2. In GitGuardian, go to Integrations › Harbor. 3. Enter your Harbor URL and the robot account name (including its robot$ prefix) and secret. 4. Choose your monitored perimeter: select specific Harbor repositories or monitor the entire instance.
    • Adds POST /v1/incidents/secrets/{id}/check-presence and POST /v1/public-incidents/secrets/{id}/check-presence endpoints to trigger an asynchronous presence check on a secret incident.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds source_monitoring_status__all operator to the public API, exposing the new is all of filter so you can isolate incidents whose sources are ALL deleted or archived.
    • Adds per-secret environment classification in NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems., reading environment from secret paths, tags, and labels (recognising prod, prd, stg, qa, uat, dev, and more) before falling back to the source-level env setting.
    • Enables developers to reply to a GitGuardian check run by commenting @gitguardian on a pull request, adding the comment as a note on every incident the check run found, visible in the dashboard and through the incident notes API.
    • Adds is all of operator to the source status filter in the UI, letting you isolate incidents whose sources are all deleted or archived.

    +3 more show less

    • Supports connecting GitGuardian to Google Cloud keyless via Workload Identity Federation, removing the need to store or rotate a service account key, with project, folder, or organization-level scopes.
    • Confluence incident notifications now carry the stable Confluence user key for new occurrences, enabling mapping of incident authors to users even when the instance does not expose emails.
    • GitLab System Hooks integrations with a non-admin token now monitor projects in personal namespaces and in groups the service account reaches only through a project.
    • Adds POST /v1/incidents/secrets/{id}/check-presence and POST /v1/public-incidents/secrets/{id}/check-presence endpoints to trigger an asynchronous presence check on a secret incident.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables developers to reply to a GitGuardian check run by commenting @gitguardian on a pull request, adding the comment as a note on every incident the check run found, visible in the dashboard and through the incident notes API.
    • Supports connecting GitGuardian to Google Cloud keyless via Workload Identity Federation, removing the need to store or rotate a service account key, with project, folder, or organization-level scopes.

    5 more in Everything

15. docs update Oct 9, 2026 · issue 098

    GitGuardian adds incident playbook multi-user assignment and GitHub team auto-creation for direct-access members⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Adds playbook auto-assign to multiple users for incident routing, enabling a single playbook to assign incidents to more than one user simultaneously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds opt-in GitHub team sync option to auto-create GitGuardian teams for GitHub users who belong to no GitHub team, grouped by the repositories they access directly, enabling 100% team coverage.
    • Adds playbook auto-assign to multiple users for incident routing, enabling a single playbook to assign incidents to more than one user simultaneously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

16. Scan your Harbor container registry for secrets (2026-10-09) Oct 9, 2026 · issue 099

    Harbor integration uses a read-only robot account, supports air-gapped instances via GitGuardian Bridge, flags unhealthy installs, and enables secret rotation without reinstall.

    • Uses a Harbor robot account with Repository (List, Pull) and Artifact (List, Read) permissions only — read-only, scoped, and revocable at any time.
    • Supports scanning Harbor instances not reachable from the internet via GitGuardian Bridge.
    • Allows selecting specific Harbor repositories or monitoring the entire instance with automatic inclusion of new repositories.
    • Performs both historical scanning of existing images and incremental scanning of newly pushed images.
    • Flags unhealthy installations (expired robot accounts, lost permissions, or unreachable instances) and supports rotating the robot account secret without reinstalling.

    +1 more show less

    • New integrationNavigate to Settings > Integrations > Sources and click Install next to Harbor in the Container registries section to configure the integration.

    6 details in Everything

17. api-docs-41a58f79d912 Oct 5, 2026 · issue 095

    GitGuardian SaaS: Introduces NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. — NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. Identity Owners API group — enabling programmatic ownership management of non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. via scopes nhi:ownership:read and nhi:ownership:write.

    └──▷ TRY IT
    Trigger a fresh presence check on a private secret incident to confirm whether its occurrences still exist in source repositories.
    copy

    $ curl -s -X POST 'https://api.gitguardian.com/v1/incidents/secrets/42/check-presence' \
      -H 'Authorization: Token <your_api_token>'

    Assign ownership of an NHI to two team members by email so they receive governance alerts for that identity.
    copy

    $ curl -s -X POST 'https://api.gitguardian.com/v1/secret-observability/identities/1234/owners' \
      -H 'Authorization: Token <your_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"owners": [{"email": "alice@example.com"}, {"email": "bob@example.com"}]}'

    List only secret incidents that have at least one source still actively monitored but archived, to triage stale exposure.
    copy

    $ curl -s 'https://api.gitguardian.com/v1/incidents/secrets?source_monitoring_status__in=archived,unreachable' \
      -H 'Authorization: Token <your_api_token>'

18. changelog Oct 5, 2026 · issue 095
    ⤢ ⤢
    └──▷ USE IT
    Set a persistent API timeout in ggshield config so every scan in the environment respects the higher limit.
    ~/.gitguardian.yaml copy

    api_timeout: 120

    └──▷ BREAKING ON UPGRADE

    • !The Health filter on the perimeter sources table is replaced by Has open incidents; existing saved views are migrated automatically.
19. api-docs-41a58f79d912 Oct 4, 2026 · issue 094

    GitGuardian SaaS: Adds POST /v1/secret-observability/identities/{identity_id}/owners to add up to 5 owners (by email) to a non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. without removing existing ones.

    └──▷ TRY IT
    Trigger a live presence re-check on a private secret incident to confirm whether the leaked credential is still present in its source repos.
    copy

    $ curl -X POST 'https://api.gitguardian.com/v1/incidents/secrets/42/check-presence' \
      -H 'Authorization: Token <your_api_token>'

    Assign an owner to an NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. identity so the responsible team member is accountable for rotating or revoking the credential.
    copy

    $ curl -X POST 'https://api.gitguardian.com/v1/secret-observability/identities/1234/owners' \
      -H 'Authorization: Token <your_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"owners": [{"email": "alice@example.com"}]}'

    Filter the incident list to surface only incidents whose sources are fully gone (archived or deleted on remote), helping triage what no longer needs active remediation.
    copy

    $ curl -G 'https://api.gitguardian.com/v1/incidents/secrets' \
      -H 'Authorization: Token <your_api_token>' \
      --data-urlencode 'source_monitoring_status__all=archived,deleted_on_remote'

    • Introduces NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. / NHI Identity Owners as a new API surface area, requiring nhi:ownership:read or nhi:ownership:write scopes and Manager access level or above (or a service account token).

    1 detail in Everything

20. changelog Oct 4, 2026 · issue 094

    GitGuardian SaaS: Replaces the Health filter on the perimeter page with a Has open incidents filter; saved views are migrated.

    ⤢ ⤢
    └──▷ USE IT
    Raise the API timeout when large scans fail with a read timeout error.
    yaml copy

    api_timeout: 120

    Set the API timeout via environment variable in a CI pipeline where config files are not practical.
    📍GITGUARDIAN_API_TIMEOUT=120 ggshield secret scan repo .
    └──▷ BREAKING ON UPGRADE

    • !The Health filter on the perimeter sources table is replaced by the Has open incidents filter; saved views are migrated automatically.
21. api-docs-41a58f79d912 Oct 3, 2026 · issue 093

    GitGuardian API adds NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. identity owner management, presence-check endpoints, and source monitoring status filters for secret incidents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Re-verify whether a leaked secret is still live on its source before closing or escalating an incident.
    copy

    $ curl -s -X POST https://api.gitguardian.com/v1/incidents/secrets/42/check-presence \
      -H 'Authorization: Token <your_api_token>'

    Assign an owner to an NHI identity programmatically so your team can track who is responsible for a non-human credential.
    copy

    $ curl -s -X POST https://api.gitguardian.com/v1/secret-observability/identities/99/owners \
      -H 'Authorization: Token <manager_api_token>' \
      -H 'Content-Type: application/json' \
      -d '{"owners": [{"email": "alice@example.com"}]}'

    Narrow an incident triage pipeline to secrets still reachable in real time by excluding those whose sources are entirely archived or deleted.
    copy

    $ curl -s 'https://api.gitguardian.com/v1/incidents/secrets?source_monitoring_status__nin=archived,deleted_on_remote' \
      -H 'Authorization: Token <your_api_token>'

    • Adds POST /v1/incidents/secrets/{incident_id}/check-presence to trigger an asynchronous presence check on a private secret incident, confirming whether occurrences still exist on their sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST /v1/public-incidents/secrets/{incident_id}/check-presence to trigger an asynchronous presence check on a public secret incident.
    • Adds GET /v1/secret-observability/identities/{identity_id}/owners to list active NHI identity owners, including both GitGuardian-suggested and manually added owners (requires Manager access level or service account token).
    • Adds POST /v1/secret-observability/identities/{identity_id}/owners to add owners to an NHI identity by email address, up to a maximum of 5 owners per identity.
    • Adds POST /v1/secret-observability/identities/{identity_id}/owners/update to replace all owners of an NHI identity atomically; an empty list removes all owners.

    +5 more show less

    • Adds DELETE /v1/secret-observability/identities/{identity_id}/owners/{owner_id} to remove a specific owner from an NHI identity and suppress future suggestions for that owner.
    • Adds source_monitoring_status__in query parameter to secret incident list endpoints to keep only incidents with at least one source in the given comma-separated monitoring status buckets (e.g. archived,unreachable); requires the monitoring-status feature on the workspace.
    • Adds source_monitoring_status__nin query parameter to exclude secret incidents where all sources fall within the specified monitoring status buckets (e.g. archived).
    • Adds source_monitoring_status__all query parameter to keep only secret incidents whose every source is in the given monitoring status buckets (e.g. archived,deleted_on_remote).
    • Introduces NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. and NHI Identity Owners as a new API surface area under /v1/secret-observability/identities, with nhi:ownership:read and nhi:ownership:write scopes.

    10 details in Everything

22. changelog Oct 3, 2026 · issue 093

    GitGuardian adds Wiz secret-findings integration, Coverage Hub, AI hook expansion to Kiro/Junie, and configurable API timeout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ USE IT
    Persist a higher API timeout in ggshield config so every scan in the environment picks it up without an env-var prefix.
    ~/.gitguardian.yaml copy

    api_timeout: 120

    • Adds api_timeout config key and GITGUARDIAN_API_TIMEOUT environment variable to override the previously fixed 60-second API timeout for large scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds native Wiz integration that syncs active GitGuardian secret incidents to Wiz as secret findings daily, carrying repository, file path, commit, detector, validity, severity, and a SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash of the secret — never the raw value.
    • Extends AI Hooks and ggshield 1.55.0+ to cover Amazon Kiro (IDE and CLI) and Junie CLI, blocking secrets in commands and file reads.
    • Adds tool-output withholding on Claude Code, Codex, and Mistral Vibe: ggshield intercepts tool output containing secrets and replaces it with a safe message so the secret never reaches the model or session transcript.
    • Introduces the Coverage Hub on the perimeter page: four cards showing installed integrations, share of sources monitored in real time, share scanned successfully, and share owned by a team — each card action filters the sources table to the gap.

    +8 more show less

    • Adds a Team column to the sources table and a No team assigned filter option to surface unowned sources; replaces the Health filter with Has open incidents.
    • Adds a new Public Monitoring agents page showing how agents classified incidents as Related, Unclear, or Not related, with counts linking to matching incidents.
    • Extends the secret value and validity API endpoints to cover secrets found through Public Monitoring, not only Internal Monitoring.
    • Adds optional author attribution for leaks detected through custom sources (BYOS), allowing an author email to be provided and returned when leaks are found.
    • Introduces a per-account setting to keep team access to unmonitored sources and their existing incidents instead of removing them from team perimeters.
    • Introduces a per-account setting to automatically remove archived sources from team perimeters.
    • Perimeter bulk actions now gray out inapplicable actions with a tooltip explanation, and show a confirmation listing skipped sources when monitoring, unmonitoring, or scanning more than 30 sources.
    • System hooks integrations with a non-admin token now monitor projects in personal namespaces and in groups the service account reaches only through a project.
    • Adds api_timeout config key and GITGUARDIAN_API_TIMEOUT environment variable to override the previously fixed 60-second API timeout for large scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds native Wiz integration that syncs active GitGuardian secret incidents to Wiz as secret findings daily, carrying repository, file path, commit, detector, validity, severity, and a SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash of the secret — never the raw value.
    • Adds tool-output withholding on Claude Code, Codex, and Mistral Vibe: ggshield intercepts tool output containing secrets and replaces it with a safe message so the secret never reaches the model or session transcript.
    • Introduces the Coverage Hub on the perimeter page: four cards showing installed integrations, share of sources monitored in real time, share scanned successfully, and share owned by a team — each card action filters the sources table to the gap.
    • Adds a new Public Monitoring agents page showing how agents classified incidents as Related, Unclear, or Not related, with counts linking to matching incidents.

    +2 more show less

    • Introduces a per-account setting to keep team access to unmonitored sources and their existing incidents instead of removing them from team perimeters.
    • Introduces a per-account setting to automatically remove archived sources from team perimeters.

    6 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Health filter on the perimeter sources table is replaced by Has open incidents; saved views using the old filter are migrated automatically.
23. announced Oct 1, 2026 · issue 093

    GitGuardian adds Agents Analysis to Public Monitoring: automatic company-relevance verdicts, an Analysis tab with reasoning, and analyst feedback controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    When triaging a flood of public exposure alerts, open the Company-related saved view first to see only incidents Agents Analysis has confirmed as belonging to your org, then drill into the Analysis tab on any incident to review the reasoning and Investigation details before deciding on remediation.
    📍In Public Monitoring, select the Company-related saved view › open an incident › click the Analysis tab to review the verdict (Related / Uncertain / Unrelated), the reasoning, and the Investigation details section.
    After reviewing an incident where Agents Analysis reached the wrong company-attribution conclusion, submit a thumbs-down with a comment so GitGuardian can improve attribution accuracy for your organization over time.
    📍In Public Monitoring, open an incident › click the Analysis tab › click the thumbs-down icon › optionally type a comment explaining the misattribution › submit.
    • Adds an Analysis tab on public incidents showing the company-relevance verdict (Related, Uncertain, or Unrelated), the reasoning behind it, and an Investigation details section tracing how the incident moved through triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds thumbs-up/thumbs-down feedback controls with optional comments on the Analysis tab, letting analysts signal when company attribution is correct or incorrect.
    • Introduces Agents Analysis, which automatically labels every analyzed public incident with a Company-related verdict and is enabled automatically for all customers using Public Monitoring.
    • Reorganizes the Public Monitoring incident list with three new saved views — Company-related, Unclear if company-related, and Not company-related — alongside the existing All and Open views.
    • Adds Company-related and Risk score columns to the Public Monitoring incident list by default.

    +1 more show less

    • Updates agent-generated risk scoring so that company-relevance (not just the secret's own characteristics) drives incident score, with Unrelated incidents receiving a score of zero and unanalyzed incidents carrying no score.
    • Adds an Analysis tab on public incidents showing the company-relevance verdict (Related, Uncertain, or Unrelated), the reasoning behind it, and an Investigation details section tracing how the incident moved through triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds thumbs-up/thumbs-down feedback controls with optional comments on the Analysis tab, letting analysts signal when company attribution is correct or incorrect.
    • Introduces Agents Analysis, which automatically labels every analyzed public incident with a Company-related verdict and is enabled automatically for all customers using Public Monitoring.

    3 more in Everything

24. docs update Sep 30, 2026 · issue 090

    Wiz integration syncs active secret incidents as native Wiz findings daily; a new Public Monitoring agents page tracks incident classification and triage counts.

    • New integrationIntegrates with Wiz to push active secret incidents from version control sources as native Wiz secret findings on a daily sync, carrying repository, file path, commit, detector, validity, severity, and a link back to the GitGuardian incident.
    • Severity of the GitGuardian incident is mapped to the severity of the corresponding Wiz finding, keeping critical secrets marked critical in both platforms.
    • Sends only a SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash of the secret and its metadata to Wiz — the raw secret value is never transmitted.
    • Automatically closes Wiz findings when the corresponding GitGuardian incident is resolved or ignored, with no manual reconciliation required.
    • Adds a Public Monitoring agents page showing how agents classified all public incidents (Related, Unclear, Not related) and how they moved through triage and deep analysis, with counts linking to matching incidents.

    5 details in Everything

25. Push your secret incidents to Wiz (2026-09-30) Sep 30, 2026 · issue 090

    GitGuardian adds a Wiz integration that syncs active secret incidents as native Wiz findings and a new agents page for public incident classification.

    • New integrationAdds a Wiz integration that daily syncs active secret incidents from version control sources into Wiz as native secret findings, carrying repository, file path, commit, detector, validity, severity, and a link back to the GitGuardian incident.
    • Transfers only a SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash of the secret and its metadata to Wiz — the raw secret value never leaves GitGuardian.
    • Maps GitGuardian incident severity directly to the Wiz finding severity, so a critical secret appears as critical in both platforms.
    • Auto-closes Wiz findings when the corresponding GitGuardian incident is resolved or ignored — each sync uploads the full active-incident list and Wiz removes findings that drop off.
    • Adds a GitGuardian agents page showing how agents classified public incidents (Related, Unclear, Not related) and their progression through triage and deep analysis, with each count linking to matching incidents.

    5 details in Everything

26. api-docs-93f0b74f7cdd Sep 29, 2026 · issue 089

    GitGuardian API gains occurrence content retrieval and scan list/poll endpoints for secrets and audit workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Fetch the exact file content and secret match positions for a known private occurrence — what a reviewer sees in the dashboard — via the API for automated triage pipelines.
    copy

    $ curl -H 'Authorization: Token <your-pat>' \
      'https://api.gitguardian.com/v1/occurrences/secrets/42/content'

    Poll for all scans that are still running or whose payload changed since a checkpoint timestamp, so a CI integration never misses a scan that finished or gained an audit summary between two polls.
    copy

    $ curl -H 'Authorization: Token <your-pat>' \
      'https://api.gitguardian.com/v1/scans?active_or_updated_since=2025-09-22T10:00:00Z'

    Retrieve a single scan's byte and element counters plus its audit summary to drive a poll-until-complete loop that waits for the audit report, not just scan completion.
    copy

    $ curl -H 'Authorization: Token <your-pat>' \
      'https://api.gitguardian.com/v1/scans/<scan_id>'

    • Adds GET /v1/occurrences/secrets/{occurrence_id}/content to retrieve the file content and secret match positions GitGuardian stored for a private occurrence, requiring a PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. with read:incident and secrets:read scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET /v1/public-incidents/secrets/{incident_id}/occurrences/{occurrence_id}/content to retrieve the same stored content for occurrences of public incidents, with the same PAT and scope requirements.
    • Adds GET /v1/scans to list historical scans in bulk — the same payload as the scan detail endpoint — supporting the active_or_updated_since query parameter (ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601) to efficiently poll only scans still running or updated since a given instant, sorted by -gg_created_at by default.
    • Adds GET /v1/scans/{scan_id} to retrieve a single scan's progress: element and byte counters plus the audit summary once available, enabling poll-until-complete workflows that distinguish scan completion from audit summary readiness.

    4 details in Everything

27. docs update Sep 29, 2026 · issue 089

    GitGuardian adds automatic source-removal rules for team perimeters based on deleted, archived, or unmonitored status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ HOW TO FIND IT
    Automatically remove unmonitored sources from a team perimeter so stale sources do not clutter a team's incident view — while keeping manager access intact.
    📍In the GitGuardian console, go to Workspace Settings › Team perimeter and enable the Unmonitored sources setting so that sources which are no longer monitored are automatically removed from all team perimeters.
28. docs update Sep 29, 2026 · issue 089

    GitGuardian's Monitored Perimeter page gains a Coverage Hub, saved views, bulk actions, and team-ownership tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Kick off historical scans for every source that has never been scanned, confirming the batch when GitGuardian prompts on selections over 30 sources.
    📍In the Monitored Perimeter page, click See unscanned sources in the Historical scans card, use 'Select all N sources that match filters', choose the Launch historical scan bulk action, and confirm the dialog.
    • Adds the Coverage Hub — four summary cards (Integrations, Real time monitoring, Historical scans, Team ownership) above the perimeter table that quantify coverage gaps and link directly to filtered source lists.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds saved views to the perimeter page, including non-editable built-in views: Monitored, Critical sources, With open secret incidents, Scanning issues, and Without honeytoken.
    • Adds Columns control to show, hide, or reorder perimeter table columns.
    • Adds bulk actions bar for acting on many sources at once, including Monitor, Unmonitor, and Launch historical scan; confirmations are required when selecting more than 30 sources or when some sources will be skipped.
    • Adds Teams column (shown by default in the Monitored view) and a No team assigned filter value to identify unowned sources.

    +2 more show less

    • Adds Last scan column with a Skipped badge and hover explanation for scans that did not run.
    • Adds team perimeter setting for unmonitored sources, letting managers keep or remove unmonitored and archived/deleted sources from team perimeters.

    7 details in Everything

29. docs update Sep 29, 2026 · issue 089

    GitGuardian SaaS: Adds optional author attribution for leaks detected through custom sources (BYOS), allowing an author email to be provided and returned when leaks are found.

    ⤢ ⤢
    └──▷ USE IT
    Raise the API timeout so that large repository scans no longer fail with a read timeout error.
    .gitguardian.yaml copy

    api_timeout: 120

    • Adds support for monitoring GitLab projects under personal namespaces even when the service account lacks namespace-level access.
    • Introduces a per-account setting to keep team access to unmonitored sources and their existing incidents instead of removing them from team perimeters.
    • Extends secret value and validity API endpoints to cover secrets found via Public Monitoring, not only Internal Monitoring.
    • Introduces a per-account setting to keep team access to unmonitored sources and their existing incidents instead of removing them from team perimeters.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Health filter on the sources table is replaced by Has open incidents; saved views using Health are migrated automatically.
30. Spot your uncovered assets. Close your blindspot in one click! (2026-09-28) Sep 28, 2026 · issue 089

    GitGuardian's new Coverage Hub surfaces unmonitored, unscanned, and unowned sources on the perimeter page with one-click remediation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Identify all sources not yet assigned to a team and bulk-assign them to close ownership gaps.
    📍In the perimeter page, click the Owned by a team card action to filter the sources table to unassigned sources, select all, then choose a bulk action to assign them. Alternatively, use the Team filter and select No team assigned to reach the same view.
    Surface integrations with unreachable sources so you can restore monitoring coverage before secrets go undetected.
    📍In the perimeter page, look for the red badge on the Coverage Hub, then click Show more details to see which integrations have unreachable sources and click the card action to filter the table to those sources.
    • Adds the Coverage Hub to the perimeter page: four cards show installed integrations, share of sources monitored in real time, share scanned successfully, and share owned by a team.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds card actions that filter the sources table to sources needing action — unmonitored, unscanned, or unassigned — in one click.
    • Adds a red badge on the Coverage Hub to count sources GitGuardian cannot reach, with a Show more details view listing integrations and flagging unreachable ones.
    • Adds a Teams column to the perimeter sources table showing the teams assigned to each source.
    • Adds a No team assigned option to the Team filter to surface sources without an owner.

    +3 more show less

    • Replaces the Health filter with Has open incidents on the perimeter page, with saved views migrated automatically.
    • Sorts the perimeter sources table by open incidents by default, prioritising sources at risk.
    • Improves bulk actions on perimeter sources: grays out inapplicable actions with explanatory tooltips, and lists skipped sources with reasons when monitoring, unmonitoring, or scanning more than 30 sources.
    • Adds the Coverage Hub to the perimeter page: four cards show installed integrations, share of sources monitored in real time, share scanned successfully, and share owned by a team.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds card actions that filter the sources table to sources needing action — unmonitored, unscanned, or unassigned — in one click.
    • Adds a red badge on the Coverage Hub to count sources GitGuardian cannot reach, with a Show more details view listing integrations and flagging unreachable ones.
    • Adds a Teams column to the perimeter sources table showing the teams assigned to each source.

    4 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Health filter on the perimeter page is replaced by Has open incidents; saved views using the old filter are migrated automatically.
31. docs update Sep 27, 2026 · issue 087
    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Prevent large-repo scans from failing with a read timeout by raising the API timeout above the old 60-second hard limit.
    📍GITGUARDIAN_API_TIMEOUT=120 ggshield secret scan repo .
    Set a persistent API timeout in the ggshield config file so every scan honours the higher limit without needing an environment variable.
    ~/.gitguardian/.gitguardian.yaml copy

    api_timeout: 120

32. api-docs-401357175309 Sep 26, 2026 · issue 086

    GitGuardian SaaS: Adds report_status field to historical scan progress responses, signalling done (with final duration_seconds, pending_seconds, and outcome_by_reason) or unavailable independently of scan_status, so callers know when the audit summary is ready rather than just when the scan has finished.

    └──▷ TRY IT
    Verify which custom GitLab (or other service) hosts your workspace has registered, so you can confirm a self-hosted instance is being checked for leaked tokens.
    copy

    $ curl -s -H 'Authorization: Token <your_api_key>' https://api.gitguardian.com/v1/detector-custom-hosts | jq '.[] | {detector: .detector_name, default: .checker_default_base_url, custom: [.custom_hosts[].base_url]}'

    Poll a historical scan until the audit summary is ready — stop on report_status of done or unavailable rather than on scan_status alone.
    copy

    $ while true; do
      resp=$(curl -s -H 'Authorization: Token <your_api_key>' "https://api.gitguardian.com/v1/historical-scans/<scan_id>/progress")
      report_status=$(echo "$resp" | jq -r '.report_status')
      echo "report_status: $report_status"
      if [ "$report_status" = "done" ] || [ "$report_status" = "unavailable" ]; then
        echo "$resp" | jq '{duration_seconds, pending_seconds, outcome_by_reason}'
        break
      fi
      sleep 5
    done

33. docs update Sep 26, 2026 · issue 086

    GitGuardian SaaS: Adds an opt-in Public Monitoring playbook that auto-ignores incidents agents rule Unrelated with reason Credential not related to the company, closed by GitGuardian Bot.

    ⤢ ⤢
34. api-docs-401357175309 Sep 25, 2026 · issue 085

    GitGuardian API adds detector custom hosts endpoint and live historical-scan progress polling⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Verify which custom GitLab (or other self-hosted) base URLs your workspace has registered for secret detection, to confirm coverage before scanning an internal repo.
    copy

    $ curl -s -H 'Authorization: Token <your_api_token>' https://api.gitguardian.com/v1/detector-custom-hosts

    • Adds live progress polling for historical scans, exposing report_status (values: running, watching, done, unavailable) alongside scan_status, with terminal fields duration_seconds, pending_seconds, and outcome_by_reason (reasons: skipped, binary_file, too_large, failed, file_not_downloadable, empty_content) available once report_status reaches done.

    1 detail in Everything

35. api-docs-e88e8519d038 Sep 25, 2026 · issue 085
    └──▷ TRY IT
    Audit which custom host URLs (e.g. self-hosted GitLab instances) are registered for each secret detector in your workspace.
    copy

    $ curl -s -H 'Authorization: Token <your_api_key>' https://api.gitguardian.com/v1/detector-custom-hosts | jq '.'

36. AI Hooks keep leaked tool output away from the model (2026-09-25) Sep 25, 2026 · issue 087

    AI Hooks now withhold tool output from Claude Code, Codex, and Mistral Vibe, and extend coverage to Kiro and Junie CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Raise the API timeout when large scans are failing with read timeouts in CI or on slow networks.
    yaml copy

    api_timeout: 120

    Register AI Hooks for Kiro and Junie CLI on a developer workstation after upgrading to ggshield 1.55.0.
    copy

    $ ggshield machine setup

    Override the API timeout via environment variable in a CI pipeline where the config file is not available.
    📍GITGUARDIAN_API_TIMEOUT=120 ggshield secret scan repo .
    • Adds api_timeout config key and GITGUARDIAN_API_TIMEOUT environment variable to override the previously fixed 60-second API timeout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds ggshield machine setup subcommand to register AI Hooks for Kiro and Junie CLI in one step.
    • AI Hooks now withhold shell-command output containing secrets from the model context on Claude Code, Codex, and Mistral Vibe — the assistant receives only the ggshield message, keeping the secret out of the model session transcript.
    • Extends AI Hooks and the AI agents/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. inventory to cover Amazon Kiro (IDE and CLI) and Junie CLI, blocking secrets in commands and file reads.
    • Adds api_timeout config key and GITGUARDIAN_API_TIMEOUT environment variable to override the previously fixed 60-second API timeout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds ggshield machine setup subcommand to register AI Hooks for Kiro and Junie CLI in one step.

    2 more in Everything

37. announced Sep 24, 2026 · issue 085

    GitGuardian publishes a Docker Sandbox Mixin Kit that auto-installs ggshield AI hooks for Claude Code, Codex, Cursor, and GitHub Copilot agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ TRY IT
    Store your GitGuardian API key securely outside the sandbox before launching, so the credential never lands inside the agent microVM.
    copy

    $ sbx secret set gitguardian

    • Adds sbx secret set gitguardian to supply a GitGuardian API key through Docker's host-side credential proxy, keeping the real token outside the sandbox microVM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Publishes a Docker Sandbox Mixin Kit on Docker Hub and GitHub that automatically installs ggshield and configures agentic AI hooks when a sandbox starts, requiring no manual setup.
    • Adds a prompt-submission hook via ggshield that scans a developer's prompt for secrets and blocks it before it reaches the AI model.
    • Adds a pre-tool-use hook via ggshield that scans file reads, shell commands, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. calls before execution and blocks the action when a secret is detected.
    • Adds a post-tool-use hook via ggshield that scans tool output and sends a desktop notification when a secret appears in the result.

    +2 more show less

    • Supports stacking the GitGuardian mixin with other kits by passing additional --kits <targeted mixin> arguments to sbx.
    • Covers Claude Code, Codex, Cursor, and VS Code with GitHub Copilot as supported coding assistants in the mixin kit.

    7 details in Everything

38. api-docs-9a01e0949b3e Sep 24, 2026 · issue 084

    GitGuardian adds GET /v1/detector-custom-hosts to list workspace-level custom hosts grouped by secret detector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Audit which custom GitLab (or other service) hosts your workspace has registered for secret detection, to verify self-hosted instances are being scanned.
    copy

    $ curl -s -H 'Authorization: Token <your_api_token>' https://api.gitguardian.com/v1/detector-custom-hosts

39. docs update Sep 24, 2026 · issue 084

    GitGuardian adds permissions sync from Bitbucket, Azure DevOps, Jira, Confluence, and JFrog Artifactory, plus Platform API notifier management⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Adds Platform API support to create, update, and delete Slack, Microsoft Teams, webhook, and email notifiers, enabling scripted and version-controlled notification setup for large workspaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds team and permissions sync from Bitbucket, automatically mirroring Bitbucket groups, projects, and repository access into GitGuardian teams and perimeters.
    • Adds team and permissions sync from Azure DevOps, automatically mirroring Azure DevOps projects, teams, and repository access into GitGuardian teams and perimeters.
    • Adds team and permissions sync from Jira and Confluence, mirroring Jira project and Confluence space access into GitGuardian teams and perimeters.
    • Adds team and permissions sync from JFrog Artifactory, mirroring Artifactory users, groups, and repository permissions into GitGuardian teams and perimeters.

    5 details in Everything

40. docs update Sep 24, 2026 · issue 084

    GitGuardian adds 10 new detectors, 8 secret analyzers, and new validators for Splunk, Artifactory, Salesforce, and Databricks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds a new detector for Brightcove OAuth credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a new detector for Infor ION API Gateway OAuth client credentials, capturing the authorization host and token endpoint when present.
    • Adds a new detector for generic Sanctum tokens.
    • Adds a new detector for Telnyx API keys with the KEY prefix.
    • Adds a new detector for Bifrost virtual keys, matched alone or together with the URL of the Bifrost deployment.

    +19 more show less

    • Adds a new detector for Bitbucket HTTP access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. with the BBDC- prefix.
    • Adds a new detector for Jira Data Center personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
    • Adds a new detector for MetaApi cloud tokens.
    • Adds a new detector for Appwrite instance encryption keys.
    • Adds a new detector for APIclub API keys.
    • Adds a new secret analyzer for AWS Cognito OAuth credentials with host.
    • Adds a new secret analyzer for Alibaba Cloud IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access..
    • Adds a new secret analyzer for Databricks access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. with hostname.
    • Adds a secret analyzer for PyPI API tokens.
    • Adds a secret analyzer for Contentful Content Management API keys.
    • Adds a new secret analyzer for DigitalOcean personal access tokens v1.
    • Adds a new secret analyzer for DigitalOcean tokens.
    • Adds a new secret analyzer for DigitalOcean OAuth application tokens v1.
    • Extends the Scaleway Token detector to catch SCW_SECRET_KEY and SCALEWAY_SECRET_KEY assignments, including when the word scaleway is absent from the document.
    • Extends the Username Password detector to also match Spanish, Portuguese, French, and Turkish username/password assignment keywords.
    • Extends the Salesforce OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Keys detector to also capture the Salesforce instance host, and switches the checker to validate against that instance's OAuth token endpoint (production or sandbox) instead of the token introspection endpoint; returns failed_to_check when no host is found.
    • Extends the Splunk Authentication Token detector to also match an optional Splunk host alongside the token, and adds a new checker that validates the token against it with custom host support.
    • Adds a checker for Artifactory reference tokens with custom host support.
    • Switches the Databricks Authentication Token With Hostname checker to a more reliable endpoint.
    • Adds a new detector for Brightcove OAuth credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a new detector for Infor ION API Gateway OAuth client credentials, capturing the authorization host and token endpoint when present.
    • Adds a new detector for generic Sanctum tokens.
    • Adds a new detector for Telnyx API keys with the KEY prefix.
    • Adds a new detector for Bifrost virtual keys, matched alone or together with the URL of the Bifrost deployment.

    +14 more show less

    • Adds a new detector for Bitbucket HTTP access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. with the BBDC- prefix.
    • Adds a new detector for Jira Data Center personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it..
    • Adds a new detector for MetaApi cloud tokens.
    • Adds a new detector for Appwrite instance encryption keys.
    • Adds a new detector for APIclub API keys.
    • Adds a new secret analyzer for AWS Cognito OAuth credentials with host.
    • Adds a new secret analyzer for Alibaba Cloud IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access..
    • Adds a new secret analyzer for Databricks access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. with hostname.
    • Adds a secret analyzer for PyPI API tokens.
    • Adds a secret analyzer for Contentful Content Management API keys.
    • Adds a new secret analyzer for DigitalOcean personal access tokens v1.
    • Adds a new secret analyzer for DigitalOcean tokens.
    • Adds a new secret analyzer for DigitalOcean OAuth application tokens v1.
    • Adds a checker for Artifactory reference tokens with custom host support.

    5 more in Everything

41. api-docs-9a01e0949b3e Sep 23, 2026 · issue 083
    └──▷ TRY IT
    Audit which custom GitLab (or other service) base URLs are registered in your workspace so secrets are checked against self-hosted instances.
    copy

    $ curl -s -H 'Authorization: Token <your_api_key>' https://api.gitguardian.com/v1/detector-custom-hosts

42. api-docs-9a01e0949b3e Sep 22, 2026 · issue 082
    └──▷ TRY IT
    Audit which non-default GitLab (or other service) base URLs GitGuardian is scanning secrets against, to verify custom host coverage before a workspace change.
    copy

    $ curl -s -H 'Authorization: Token <your_api_token>' https://api.gitguardian.com/v1/detector-custom-hosts | jq '.[] | {detector: .detector_name, default: .checker_default_base_url, custom: [.custom_hosts[].base_url]}'

43. api-docs-9a01e0949b3e Sep 21, 2026 · issue 081

    GitGuardian API adds GET /v1/detector-custom-hosts to list workspace custom hosts grouped by secret detector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Audit which custom host URLs (e.g. self-hosted GitLab instances) are registered for each secret detector in your workspace.
    copy

    $ curl -H 'Authorization: Token <your_api_token>' https://api.gitguardian.com/v1/detector-custom-hosts

44. docs update Sep 15, 2026 · issue 075

    GitGuardian roadmap adds integrations and protections including ServiceNow VR, Azure DevOps Boards, Linear, Mattermost, Google Chronicle SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions., Docker Hub presence checks, and GitHub/GitLab issue integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Adds ServiceNow Vulnerability Response (VR/AVR) integration to push GitGuardian secret incidents into ServiceNow with risk scoring, bi-directional status sync, and ServiceNow RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists./ABACABACAttribute-based access control, where rules evaluate facts about the user, resource and request. Access can depend on conditions such as department, data sensitivity or device status. controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Azure DevOps Boards integration to automatically create and sync Azure DevOps work items from GitGuardian incidents.
    • Adds Google Chronicle SOAR integration to send GitGuardian secret incidents natively, enabling playbook triggering and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared.-driven remediation orchestration.
    • Adds Linear integration to automatically create and sync Linear issues from GitGuardian incidents alongside engineering backlogs.
    • Adds Mattermost integration for incident alerting, delivering GitGuardian notifications to Mattermost channels with the same options as Slack and Teams.

    +6 more show less

    • Adds GitHub Issues integration to automatically create issues on affected repositories when secrets are detected, reaching developers in their existing workflow.
    • Adds GitLab Issues integration to automatically create and track GitLab issues from GitGuardian incidents, enabling remediation without a GitGuardian account.
    • Adds a Docker Hub presence check to show whether a secret leaked in a public Docker Hub image is still exposed or whether the image has since been deleted or made private.
    • Adds custom email sender support for notification emails, allowing customers to send from their own domain so recipients recognize the sender as internal.
    • Adds a GitGuardian Power for Amazon Kiro with secret-detection skill guidelines, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. configuration, and hooks to secure AI-assisted development.
    • Adds Public Monitoring support on self-hosted GitGuardian instances, bringing public secret leak detection to on-premises deployments.

    11 details in Everything

45. docs update Sep 15, 2026 · issue 075

    GitGuardian now links AWS access keys stored in secrets managers, Vault, or Kubernetes to their AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. identity in the identity map.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
46. api-docs-b91fddb85ba2 Sep 14, 2026 · issue 074

    GitGuardian SaaS: Extends team read and write endpoints to accept secrets:read and secrets:write scoped API keys, supporting both personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. and service account tokens.

47. api-docs-b91fddb85ba2 Sep 13, 2026 · issue 073

    GitGuardian API adds external_provider_type field with Okta support for team management endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

48. api-docs-b91fddb85ba2 Sep 12, 2026 · issue 072

    GitGuardian SaaS: Adds external_provider_type field (supporting "okta" as a valid value) to team-related API endpoints, enabling callers to read and write the external identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. associated with a team.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

49. api-docs-b91fddb85ba2 Sep 11, 2026 · issue 071

    GitGuardian SaaS: Adds external_provider_type field to team API objects, with "okta" as a supported value, enabling identification of Okta-managed teams via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

50. api-docs-b91fddb85ba2 Sep 10, 2026 · issue 070

    GitGuardian API adds external_provider_type field with Okta support for team management endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

51. changelog Sep 8, 2026 · issue 068

    GitGuardian adds AI agent/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. secret blocking and vault secret classification via ggshield 1.54.0 and ggscout 0.32.0

    ⤢ ⤢
    └──▷ TRY IT
    Bootstrap AI agent secret blocking across an entire developer machine — covers every detected agent (Codex, Cursor, Claude Code, etc.) plus git hooks in one step.
    copy

    $ ggshield machine setup

    After a credential compromise, reconstruct which MCP tool calls an agent made by replaying its transcripts — useful for blast-radius analysis.
    copy

    $ ggshield ai discover --history

    • Adds AI Hooks to block secrets at prompt submission, pre-tool usetool useA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions., and post-tool use for Codex and Mistral Vibe, alongside existing Claude Code, Cursor, Copilot CLI, and VS Code coverage.
    • Runs the Secrets Detection Engine on every value ggscout collects, classifying vaulted secrets against 550+ detectors including multi-match detectors.
    • Adds detector, detector type, secret family, secret category, and secret provider filters and sort options to the NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. inventory.
    • Groups multi-match credentials (e.g. PostgreSQL username, password, host, and port) as a single inventory entry rather than separate fields.
    • Labels unmatched secrets as Unknown in the inventory so they remain visible and filterable without being dropped.

    +1 more show less

    • Adds per-team incident permission controls when promoting a user to Member, including bulk application and post-promotion editing of team rights.
    • Runs the Secrets Detection Engine on every value ggscout collects, classifying vaulted secrets against 550+ detectors including multi-match detectors.
    • Adds detector, detector type, secret family, secret category, and secret provider filters and sort options to the NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. inventory.
    • Groups multi-match credentials (e.g. PostgreSQL username, password, host, and port) as a single inventory entry rather than separate fields.
    • Labels unmatched secrets as Unknown in the inventory so they remain visible and filterable without being dropped.

    2 more in Everything

52. docs update Sep 8, 2026 · issue 068

    GitGuardian adds Docker Hub monitoring, intelligent perimeter-free attribution, unified exclusion rules, and a new agents overview page for public incidents.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Review how many of your public incidents the agents have analysed and drill into company-attribution verdicts.
    📍In the GitGuardian console, go to Public Monitoring › GitGuardian agents to see the breakdown of agent-analysed incidents and their company-attribution verdicts, then click through to the matching incidents.
    Consolidate all your monitoring exclusions — sources, file paths, and patterns — into one place to reduce management overhead.
    📍In the GitGuardian console, go to Settings › Monitoring › Exclusion Rules to add or migrate source exclusions, file-path exclusions, and pattern exclusions into the Unified Exclusion Rules experience.
    • Adds a GitGuardian agents overview page under Public Monitoring showing how many public incidents the agents analysed and how company-attribution verdicts break down, with one-click filtering to matching incidents.
    • Adds continuous Docker Hub monitoring, scanning public images daily and attributing exposures to your company as they appear after the initial historical scan.
    • Adds intelligent attribution beyond your monitored perimeter for new GitHub commits, attributing public leaks to your company even when no perimeter rule matches.
    • Adds intelligent attribution beyond your monitored perimeter for GitHub commit history, surfacing past leaks that no perimeter rule ever attributed to your company.
    • Adds intelligent attribution beyond your monitored perimeter for Docker Hub images, attributing leaks found in public Docker Hub images even when no perimeter rule matches.

    +6 more show less

    • Adds Unified Exclusion Rules for Monitoring, consolidating source exclusions, file-path exclusions, and pattern exclusions into a single unified experience.
    • Adds immediate agent analysis on new public incidents, making company-attribution verdicts and risk scores available as soon as an incident is created.
    • Adds full agent analysis coverage on public incidents, ensuring company attribution and risk scores are present on every incident including those previously skipped.
    • Adds decoded JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. and Base64 payload exposure in incident views.
    • Enables assigning multiple users to incidents and automatically assigns the leaker as assignee.
    • Scopes historical scans to each developer's time in perimeter, excluding activity from before they joined, with support for recurring scan schedules that apply new detectors to past commits.
    • Adds a GitGuardian agents overview page under Public Monitoring showing how many public incidents the agents analysed and how company-attribution verdicts break down, with one-click filtering to matching incidents.
    • Adds continuous Docker Hub monitoring, scanning public images daily and attributing exposures to your company as they appear after the initial historical scan.
    • Adds intelligent attribution beyond your monitored perimeter for new GitHub commits, attributing public leaks to your company even when no perimeter rule matches.
    • Adds intelligent attribution beyond your monitored perimeter for GitHub commit history, surfacing past leaks that no perimeter rule ever attributed to your company.
    • Adds intelligent attribution beyond your monitored perimeter for Docker Hub images, attributing leaks found in public Docker Hub images even when no perimeter rule matches.

    +1 more show less

    • Adds decoded JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. and Base64 payload exposure in incident views.

    5 more in Everything

53. docs update Sep 8, 2026 · issue 068

    GitGuardian adds AI Hooks and agent/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. inventory to Developer Endpoint Protection, plus IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. identity linking for stored AWS keys

    ⤢ ⤢
    └──▷ TRY IT
    Bootstrap AI Hook and git hook coverage across every AI agent detected on a developer machine in one step.
    copy

    $ ggshield machine setup

    After a credential compromise, reconstruct which MCP tool calls were made by parsing the agent's saved transcripts.
    copy

    $ ggshield ai discover --history

    • Adds AI Hooks to Developer Endpoint Protection, scanning prompt submission, pre-tool usetool useA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions., and post-tool use for secrets across Claude Code, Cursor, Copilot CLI, VS Code, Codex, and Mistral Vibe — a block names the secret and how to remove it so the developer or agent can fix and retry.
    • Adds ggshield machine setup to configure hooks for every detected AI agent on a machine alongside git hooks, replacing per-agent manual setup.
    • Adds a workspace setting to automatically remove sources deleted on the remote from team perimeters, while keeping them accessible to workspace managers.

    3 details in Everything

54. docs update Sep 8, 2026 · issue 068

    GitGuardian adds six new detectors (Firebase, Coze, Keycloak, Fish Audio, Azure Custom Vision) plus an Apify analyzer and Docker Hub PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. detection.

    • Adds docker login --username / -u detection to the Docker Credentials detector, catching Docker Hub personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. used in that login pattern.
    • Adds new Firebase ID Token detector for Firebase ID tokens.
    • Adds new Coze Access Token detector for Coze access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..
    • Adds new Keycloak Access Token detector for Keycloak access tokens.
    • Adds new Keycloak Refresh Token detector for Keycloak refresh and offline tokens.

    +6 more show less

    • Adds new Fish Audio API Key detector for Fish Audio API keys.
    • Adds new Azure Custom Vision Training Key detector for Azure Custom Vision Training keys.
    • Adds new Apify API tokens analyzer.
    • Extends New Relic Key and New Relic Insights Insert Key checkers to identify revoked keys via an empty POST request.
    • Improves scaleway_token precision by rejecting node UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. from proxy-subscription configs.
    • Improves fastly_personal_token precision by rejecting proxy-subscription node passwords and 32-char prefixes of longer base64url values.
    • Adds new Firebase ID Token detector for Firebase ID tokens.
    • Adds new Coze Access Token detector for Coze access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..
    • Adds new Keycloak Access Token detector for Keycloak access tokens.
    • Adds new Keycloak Refresh Token detector for Keycloak refresh and offline tokens.
    • Adds new Fish Audio API Key detector for Fish Audio API keys.

    +2 more show less

    • Adds new Azure Custom Vision Training Key detector for Azure Custom Vision Training keys.
    • Adds new Apify API tokens analyzer.

    4 more in Everything

55. docs update Sep 8, 2026 · issue 068

    GitGuardian adds ggshield machine setup and ggshield machine doctor to protect endpoints with AI Hooks, git hooks, and honeytokens.

    └──▷ TRY IT
    Set up all three endpoint protections (AI Hooks, git hooks, honeytoken) on a developer machine in one step, including the extra scope needed to plant the decoy credential.
    copy

    $ ggshield auth logout
    ggshield auth login --scopes honeytokens:write
    ggshield machine setup

    Deploy endpoint protections across a fleet without planting honeytokens, using only the default install-script scopes.
    copy

    $ ggshield machine setup --no-honeytokens

    Verify that AI Hooks, git hooks, and token scopes are all correctly configured after running machine setup.
    copy

    $ ggshield machine doctor

    • Adds ggshield machine setup command (requires ggshield 1.53.0+) to configure all three endpoint protections in one idempotent run: AI Hooks for every AI coding agent found, pre-commit/pre-push git hooks in the global git configuration, and a honeytoken decoy AWS credential profile.
    • Adds --no-honeytokens, --no-ai-hooks, and --no-git-hooks flags to ggshield machine setup to selectively skip individual protections.
    • Adds ggshield machine doctor command (requires ggshield 1.53.0+) to report per-AI-agent hook installation status, git hook status, and token scope validity.
    • Adds honeytokens:write scope requirement to ggshield auth login for planting honeytoken decoy credentials, gated behind the workspace Manager role.
    • Adds honeytokens:check, endpoints:send, and ai-discover:send default authentication scopes provisioned by the install script to cover scanning, AI Hooks, and git hooks.

    5 details in Everything

56. docs update Sep 8, 2026 · issue 068

    GitGuardian adds AI Hooks to block secrets in AI coding tool prompts and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool calls, with ClickHouse-backed agent session scanning.

    • Adds AI Hooks to block secrets in prompts and tool calls in AI coding tools before they leak via developer AI agents.
    • Requires ClickHouse on self-hosted instances to support machine scans with secrets findings, MCP tool calls, and complete AI agent session recording.

    2 details in Everything

57. announced Sep 7, 2026 · issue 070

    GitGuardian Public Secrets Monitoring adds dual AI agents delivering company-related verdicts, risk scores, and visible reasoning for every public incident.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Review the AI-generated reasoning for a public incident before deciding whether to escalate a credential rotation to your engineering team.
    📍In the Public Secrets Monitoring incident list, open an incident, then select the Analysis tab to see the triage agent reasoning, the deep analysis verdict (Related / Uncertain / Unrelated), and the agent-computed risk score.
    • Adds an Analysis tab to the incident investigation details view, showing triage reasoning, deep-analysis findings, and the timeline of both AI agent passes so reviewers can inspect the logic behind each verdict.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a triage AI agent and a deep analysis AI agent that run over every public GitHub and Docker Hub incident, returning a company-related verdict (Related, Uncertain, or Unrelated) and an agent-computed risk score.
    • Ships three pre-configured saved views covering company-related, unclear if company-related, and not company-related incidents, so teams open a pre-triaged queue instead of a flat incident list.
    • Enables Agents Analysis by default for new Public Secrets Monitoring workspaces, with gradual rollout to existing workspaces; customers can request early access through their Customer Success Manager.

    4 details in Everything

58. See all your AI agents across the fleet. Stop them leaking your secrets. (2026-09-07) Sep 7, 2026 · issue 068

    GitGuardian adds AI agent/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. inventory and ggshield machine setup to block secrets leaking through AI coding tools.

    └──▷ TRY IT
    Bootstrap AI Hook and git hook protection across all detected AI agents on a developer machine in one shot.
    copy

    $ ggshield machine setup

    After a suspected compromise, reconstruct which MCP tools an agent called by replaying its transcript history.
    copy

    $ ggshield ai discover --history

    • Adds ggshield machine setup command to configure AI Hooks and git hooks for every detected AI agent on a machine in a single step.
    • Adds --history flag to ggshield ai discover to parse MCP tool calls from agent transcripts for post-compromise investigation.
    • Adds AI Hooks coverage for Codex and Mistral Vibe, joining Claude Code, Cursor, Copilot CLI, and VS Code — scanning prompt submission, pre-tool usetool useA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions., and post-tool use, and blocking with a named secret and remediation hint.
    • Adds AI agents and MCP inventory to Developer Endpoint Protection, reporting agents and MCP servers per endpoint, hook coverage, and whether an agent subscription is personal or company-owned.
    • Adds automatic removal of remotely-deleted sources from team perimeters via a new workspace setting, while keeping them accessible to workspace managers.

    +1 more show less

    • AWS access keys stored in a secret manager or Kubernetes now link to their IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. identity by AccessKeyId, showing permissions of the stored key in the NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. exploration map.
    • Adds ggshield machine setup command to configure AI Hooks and git hooks for every detected AI agent on a machine in a single step.
    • Adds --history flag to ggshield ai discover to parse MCP tool calls from agent transcripts for post-compromise investigation.
    • Adds AI agents and MCP inventory to Developer Endpoint Protection, reporting agents and MCP servers per endpoint, hook coverage, and whether an agent subscription is personal or company-owned.

    3 more in Everything

59. docs update Sep 5, 2026 · issue 065

    GitGuardian ggscout 0.32.0 brings Secrets Detection Engine classification to vaulted secrets, with 550+ detectors and multi-match grouping

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Filter your NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. inventory down to real credentials by detector type and secret provider, excluding noise and unknowns.
    📍In the NHI inventory, open the Detector column filter and select the desired detector type, secret family, secret category, or secret provider to isolate real credentials from placeholders and feature flags.
    • Requires ggscout version 0.32.0 or later to enable Secrets Detection Engine classification on vault, CI, and Kubernetes secrets.
    • Runs the Secrets Detection Engine — the same 550+ detectors used for code scanning, including multi-match detectors — against every value ggscout collects, classifying vaulted secrets as real credentials, noise, or Unknown.
    • Adds Detector column and filter controls to the NHI inventory, letting you filter and sort by detector, detector type, secret family, secret category, and secret provider.
    • Retains unmatched secrets in the inventory labeled Unknown so they remain visible and filterable without being silently dropped.
    • Adds per-team incident permission controls when promoting a user to Member, including bulk-apply and post-promotion editing of team rights.
    • Requires ggscout version 0.32.0 or later to enable Secrets Detection Engine classification on vault, CI, and Kubernetes secrets.
    • Runs the Secrets Detection Engine — the same 550+ detectors used for code scanning, including multi-match detectors — against every value ggscout collects, classifying vaulted secrets as real credentials, noise, or Unknown.
    • Retains unmatched secrets in the inventory labeled Unknown so they remain visible and filterable without being silently dropped.

    2 more in Everything

60. Vaulted Secrets Now Classified by Value (2026-09-04) Sep 4, 2026 · issue 065

    GitGuardian runs its 550+ Secrets Detection Engine on vaulted secrets, with detector/family/category/provider filters in NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems..

    └──▷ HOW TO FIND IT
    Review classified vault secrets filtered to a specific provider in the NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. inventory after ggscout has run.
    📍In the GitGuardian console, go to NHI Governance → Identities, click the Detector column header to sort, then open the filter panel and select a value under Secret provider to scope the inventory to credentials from that provider.
    • Adds Detector column to the NHI Governance → Identities inventory, filterable by detector, detector type, secret family, secret category, and secret provider — the same filter set used for code-scanning incidents.
    • Runs the Secrets Detection Engine (550+ detectors, including multi-match detectors) on every value ggscout collects from vaults, CI systems, and Kubernetes clusters, classifying each secret by its actual value rather than its name or path.
    • Groups sibling fields that form a single credential (e.g. PostgreSQL username, password, host, and port) into one inventory entry instead of four separate items.
    • Labels unmatched secrets as Unknown in the inventory so they remain visible and can be excluded without being dropped entirely.
    • Teams Management now allows setting per-team incident permissions when promoting a user to Member, applying one permission in bulk, and editing team rights afterward.
    • Adds Detector column to the NHI Governance → Identities inventory, filterable by detector, detector type, secret family, secret category, and secret provider — the same filter set used for code-scanning incidents.
    • Runs the Secrets Detection Engine (550+ detectors, including multi-match detectors) on every value ggscout collects from vaults, CI systems, and Kubernetes clusters, classifying each secret by its actual value rather than its name or path.
    • Groups sibling fields that form a single credential (e.g. PostgreSQL username, password, host, and port) into one inventory entry instead of four separate items.
    • Labels unmatched secrets as Unknown in the inventory so they remain visible and can be excluded without being dropped entirely.

    1 more in Everything

61. docs update Sep 1, 2026 · issue 061

    GitGuardian adds AI agents for public secret attribution, source health management for GitHub, and automatic monitoring toggles for Jira, Confluence, and Teams.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Triage only the public leaks the AI agents flagged as related to your company, ignoring noise from unrelated repositories.
    📍In the Public Monitoring incidents view, open the Company-related filter and select Related, then sort by risk score descending to prioritize the highest-risk leaks the agents attributed to your company.
    └──▷ BREAKING ON UPGRADE

    • !On public incidents, the agents' risk score replaces the ML risk score, and the Context related to company tag is superseded by the Company-related verdict. Risk score filtering is no longer available for notifications on public incidents.
62. announced Aug 31, 2026 · issue 060

    GitGuardian now scans AWS S3 buckets, including ZIP and tar.gz archives, for exposed secrets routed into existing incident workflows.

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    When onboarding S3 to your monitored perimeter to surface years of credential debt in backup, CI/CD, and infrastructure buckets.
    📍In GitGuardian, go to Perimeter › Sources › AWS S3, select the buckets you want monitored, and trigger a historical scan to analyze existing objects for exposed credentials.
    • Adds AWS S3 bucket scanning to GitGuardian's monitored perimeter, performing historical scans of accumulated objects — including backups, CI/CD logs, and Terraform state files — to surface exposed credentials as incidents.
    • Extends S3 secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. into supported ZIP and tar.gz archives, surfacing credentials stored inside compressed objects that are not directly visible in the S3 console.
    • Routes S3 findings into existing GitGuardian incident workflows, enabling triage, ownership assignment, and remediation alongside secrets found in other sources.

    3 details in Everything

63. changelog Aug 31, 2026 · issue 060

    GitGuardian adds AI-agent verdicts on public leaks, AWS S3 bucket scanning, and auto-monitoring for Jira, Confluence, and Teams.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Triage public leaks by company relevance — filter to only incidents the AI agents flagged as Related to your company so your team works the leaks most likely to be yours first.
    📍In the GitGuardian dashboard, open Public Monitoring › Incidents, then use the Company-related filter and select Related. Alternatively, open one of the three ready-made saved views (Related, Uncertain, Unrelated) from the saved views menu.
    Connect an AWS S3 bucket for secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. without handing over long-lived keys — set up the OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. provider and scoped IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role, then register the account in GitGuardian.
    📍In the GitGuardian dashboard, go to Integrations › AWS S3 and follow the three-step setup: (1) create the OIDC provider in AWS, (2) create a read-only IAM role scoped to the buckets you want monitored, (3) enter your AWS account ID and role name in the integration settings. Then select individual buckets, assign them to teams, and trigger a historical scan.
    • Adds AI-agent analysis of public secret incidents, producing a Company-related verdict (Related, Uncertain, or Unrelated) available as a column, a filter, and three ready-made saved views — replacing the ML risk score on public incidents.
    • Adds a new Analysis tab on public incidents showing the company the agents identified, their reasoning, the risk score with its rationale, and which agent concluded.
    • New AWS S3 bucket scanning integration: connects via OIDC-assumed read-only IAM role (no long-lived keys), lets you select individual buckets and assign them to teams, scans objects and contents of archives (e.g. tar.gz), and surfaces findings as regular incidents with existing severity, validity, playbooks, and notifications.
    • AWS S3 scanning defaults to the integration's region and S3 Standard storage class; cross-region scanning and other storage classes are opt-in to control retrieval and transfer costs.
    • Adds automatic monitoring and automatic scan toggles for Jira Cloud, Jira Data Center, Confluence Cloud, Confluence Data Center, and Microsoft Teams — new spaces, projects, and channels are picked up without manual addition.

    +2 more show less

    • Sources health management for GitHub now pauses real-time ingestion and historical scans on unreachable GitHub sources, auto-resumes on recovery, and surfaces an actionable recovery step.
    • Adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management./SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. sign-in support when the identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. does not supply first and last name, deriving these values from the user's email address.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !When AI-agent analysis is enabled, the agents' risk score replaces the ML risk score on public incidents, and the Context related to company tag is superseded by the Company-related verdict; risk score filtering is no longer available for notifications on public incidents.
64. api-docs-6d60f7883285 Aug 28, 2026 · issue 058

    GitGuardian API adds risk score range filters for incidents and new scan byte counters.

    • Adds risk_score minimum and maximum filter parameters to incident list endpoints, allowing queries that bound results by risk score range (incidents with a null risk score are excluded from filtered results).
    • Adds data_downloaded_bytes and data_scanned_bytes counters to scan progress reporting, tracking byte-level scan telemetry alongside existing element counters (reported as null for sources that do not measure bytes, such as VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. repositories).
    • Extends user name component handling so that omitting name fields on a member update preserves the existing stored name rather than blanking it, with given/family name derived by splitting the email local part on the first dot.

    3 details in Everything

65. GitGuardian agents tell you which Public Monitoring incidents are actually yours (2026-08-27) Aug 27, 2026 · release notes

    GitGuardian introduces AI agents for public monitoring incidents, adding Company-related verdicts and agent risk scores.

    • Adds a Company-related verdict (Related, Uncertain, Unrelated) to public secret incidents, available as a column, filter, and saved views.
    • Introduces an Analysis tab showing the identified company, verdict reasoning, score rationale, and the specific agent that concluded.
    • Adds source health management for GitHub, pausing ingestion/scans on unreachable sources and auto-resuming upon recovery.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Context related to company tag is superseded by the Company-related verdict.
    • !Risk score filtering is no longer available for notifications on public incidents because agent analysis arrives asynchronously.
66. docs update Aug 25, 2026 · issue 056

    GitGuardian now scans AWS S3 buckets — including objects inside archives — using the same detection engine and incident workflow as repositories.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Set up the AWS S3 integration in GitGuardian by creating the OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. provider and read-only IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role, then registering your account.
    📍In the GitGuardian console, go to Integrations › AWS S3 and follow the three-step setup: create the OIDC provider in AWS, create the read-only IAM role scoped to the buckets you want monitored, then enter your AWS account ID and role name in the integration settings.
    • Adds AWS S3 bucket scanning via a read-only OIDC-assumed IAM role in your own account — no long-lived AWS keys required — surfacing secrets in CI logs, Terraform state, .env files, support exports, and other objects that code scanners never reach.
    • Scans inside archives (e.g. tar.gz) nested within S3 objects, so credentials buried in compressed backups still surface as incidents with severity, validity, playbooks, and notifications.
    • Lets you select individual buckets to monitor and assign them to teams like any other source, starting with high-risk buckets such as backup and log archives.

    3 details in Everything

67. Scan your AWS S3 buckets for secrets (2026-08-25) Aug 25, 2026 · issue 056

    GitGuardian can now scan AWS S3 buckets for secrets, including inside archives, using OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. role assumption with no long-lived keys.

    └──▷ HOW TO FIND IT
    Connect an AWS account so GitGuardian can scan S3 buckets without handing over long-lived keys.
    📍In GitGuardian, go to Integrations › AWS S3, then follow the three-step setup: create the OIDC provider in AWS, create a read-only IAM role scoped to the buckets you want monitored, and register your AWS account ID and role name in the integration settings.
    Kick off a historical scan on high-risk buckets (backup archives, log stores) to surface secrets that have never been visible to code scanners.
    📍In GitGuardian, go to Integrations › AWS S3 › your connected account, select the individual buckets to scan (e.g. your backup and log-archive buckets), assign them to the relevant team, and click Trigger historical scan.
    • Adds AWS S3 bucket scanning powered by the same detection engine and incident workflow used for repositories, surfacing secrets in objects across CI logs, Terraform state, database dumps, .env files, and support exports.
    • Opens and scans inside archives (e.g. tar.gz) found in S3 objects, so secrets buried in compressed backups still surface as incidents.
    • Connects via OIDC — GitGuardian assumes a read-only IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role you create and scope in your own AWS account, with no long-lived AWS keys required.
    • Lets you select individual buckets to monitor and assign them to teams, the same way any other source is managed in the integration settings.
    • Scans are scoped to the integration's configured region and S3 Standard storage class by default; cross-region scanning and other storage classes are opt-in to keep retrieval and transfer costs under control.

    +2 more show less

    • Incidents found in S3 objects carry the same severity ratings, validity status, playbooks, and notifications as code-repository incidents.
    • Historical (on-demand) scans are available now; recurrent scanning of new and modified objects is coming soon.

    7 details in Everything

68. docs update Aug 23, 2026 · issue 054

    GitGuardian adds Cloudsmith container registry support for Secret Scanning

    ⤢ ⤢
69. api-docs-983de2edf972 Aug 16, 2026 · issue 047

    GitGuardian API adds three new endpoints: secret-location listing by incident or source, and live scan progress polling.

    └──▷ TRY IT
    Find every file still exposing the secret for a given incident, scoped to actively monitored sources with more than one mention, to prioritize remediation.
    copy

    $ curl -s -H 'Authorization: Token <api_key>' 'https://api.gitguardian.com/v1/incidents/secrets/42/locations?monitored=true&number_of_mentions_min=2&ordering=-number_of_mentions'

    Poll a running historical scan for live progress counters and stop when completed is returned, then fetch the audit summary from audit_url.
    copy

    $ curl -s -H 'Authorization: Token <api_key>' 'https://api.gitguardian.com/v1/scans/<scan_id>/live-progress'

    List all secret locations in a specific source that match a filepath pattern, to hand off an exact file list to the owning team.
    copy

    $ curl -s -H 'Authorization: Token <api_key>' 'https://api.gitguardian.com/v1/sources/5523/locations?search=settings.py&code_fix_request_status=created'

    • New GET /v1/incidents/secrets/{incident_id}/locations endpoint lists every file on a source's default branch that still holds a secret, with exact line positions, filterable by source, number_of_mentions_min, number_of_mentions_max, code_fix_request_status (processing, created, error), and search (filepath substring), sortable by last_updated_at, number_of_mentions, or source.
    • New GET /v1/sources/{source_id}/locations endpoint lists all files in a single source that still hold any secret on the default branch, carrying the same per-match line positions, filters (number_of_mentions_min, number_of_mentions_max, code_fix_request_status, search), and sort options as the incident-level endpoint.
    • New beta GET /v1/scans/{scan_id}/live-progress endpoint returns the live status (queued, in_progress, completed) and real-time counters (elements_scanned, elements_total, elements_skipped, elements_failed, data_downloaded_bytes, data_scanned_bytes) for a running historical scan, and includes an audit_url field once the scan reaches completed.

    3 details in Everything

70. changelog Aug 16, 2026 · issue 047

    GitGuardian adds custom secret validity via API, honeytoken endpoint protection, and programmatic PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it./SAT token creation.

    ⤢ ⤢
    └──▷ TRY IT
    Plant a honeytoken on a developer machine to detect credential-harvesting malware the moment it reads the credential file.
    copy

    $ ggshield honeytoken plant

    • New API endpoint lets teams push their own validity status (valid or invalid) for secrets on unreachable internal systems, using a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. with the secrets:write scope; the status propagates to all incidents for that secret, appears as Custom validity with a datestamp, and is recorded in the incident activity log and audit log.
    • New ggshield honeytoken plant command (existing agent binary) plants a decoy AWS credential on developer endpoints; any use of the decoy triggers an alert naming the compromised machine, its IP address, user agent, and timestamp — no new agent required.
    • New Honeytoken protection card in the Endpoints dashboard reports fleet coverage percentage and lists unprotected endpoints.
    • Adds ability to create Personal Access Tokens (PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) and Service Account Tokens (SATs) programmatically via the API for automated token rotation workflows; tokens created via the API must have a finite TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit..
    • Scans triggered via a Personal Access Token now emit an audit log event.

    5 details in Everything

71. docs update Aug 15, 2026 · issue 046

    GitGuardian adds an API to let customers override the validity status of a detected secret.

    ⤢ ⤢
72. docs update Aug 15, 2026 · issue 046

    GitGuardian adds custom validity reporting via API, Azure DevOps pipeline decorator, and API-driven detector filtering for custom sources.

    ⤢ ⤢
    • New API endpoint lets practitioners set a custom validity status (valid or invalid) on secrets from internal or private systems — requires a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. with the secrets:write scope — so GitGuardian can surface that status in filters, severity, and all downstream incident workflows.
    • Custom validity status is displayed as Custom validity with the date it was set on every incident for that secret, and setting or removing it is recorded in both the incident activity log and the audit log.
    • Adds the Only use detectors with validators option to the public API when creating or updating custom sources, enabling fully automated and consistent source configuration.
    • Launches an Azure DevOps extension that lets admins add a ggshield secret scan job to every pipeline in their organization with a single pipeline decorator via Azure Pipelines.

    4 details in Everything

73. Set your own validity status on a secret (2026-08-14) Aug 14, 2026 · issue 046

    GitGuardian lets you set custom validity status on secrets via API, plus new source configuration options in the public API.

    • New API capability to set your own validity status (valid or invalid) on secrets that GitGuardian cannot reach — requires a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. with the secrets:write scope.
    • Incidents display Custom validity with the date it was set, distinguishing user-provided status from GitGuardian-checked status, recorded in both the incident activity log and the audit log.
    • The custom validity status applies to the secret itself, so every incident tied to that secret reflects the status.
    • Public API now supports setting the Only use detectors with validators option when creating or updating custom sources, enabling fully automated source configuration.

    4 details in Everything

74. api-docs-1c2e4c9efcfd Aug 12, 2026 · issue 043

    GitGuardian adds use_only_detectors_with_validators to custom source APIs, filtering scans to only secrets with validity checks.

    └──▷ TRY IT
    When creating or updating a custom source, restrict its scan results to secrets that can be actively validated — cutting noise from detectors that cannot confirm whether a secret is live.
    copy

    $ curl -X PATCH https://api.gitguardian.com/v1/sources/custom/<source_id> \
      -H 'Authorization: Token <api_key>' \
      -H 'Content-Type: application/json' \
      -d '{"use_only_detectors_with_validators": true}'

75. docs update Aug 11, 2026 · issue 042

    GitGuardian adds honeytoken-based endpoint intrusion detection, programmatic PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it./SAT creation via API, and expanded VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. source health management.

    ⤢ ⤢
    └──▷ TRY IT
    Plant a honeytoken on a developer workstation to detect credential-stealing malware the moment it reads the credential file.
    copy

    $ ggshield honeytoken plant

    • Adds ggshield honeytoken plant command to plant a decoy AWS credential on developer endpoints — any access to the decoy triggers an alert naming the compromised machine, its IP address, user agent, and timestamp.
    • New Honeytoken protection card in the Endpoints dashboard reports the share of the fleet with active honeytoken coverage and lists unprotected endpoints.
    • Adds API endpoints to create Personal Access Tokens (PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) and Service Account Tokens (SATs) programmatically, enabling automated token rotation workflows; tokens created via the API must have a finite TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit..
    • Scans triggered via a Personal Access Token now emit an audit log event.
    • Extends source health management to Bitbucket Cloud, Bitbucket Data Center, GitLab, and Azure DevOps: GitGuardian now pauses real-time ingestion and historical scans on unreachable sources, auto-resumes on recovery, and surfaces an actionable recovery step.

    5 details in Everything

76. docs update Aug 11, 2026 · issue 042

    GitGuardian adds 10 new detectors/checkers for Lovable, Slack, n8n, Atlassian, AWS Cognito, OpenAI, Vercel, OpenCode, and Supabase.

    • Adds Lovable Access Token detector for Lovable project access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..
    • Adds Lovable Git Token detector for Lovable git tokens.
    • Adds Slack Webhook Trigger URL detector for Slack Workflow Builder webhook trigger URLs.
    • Adds n8n API Key detector for n8n API keys.
    • Adds Atlassian Auth Key detector for Atlassian OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. access tokens issued by auth.atlassian.com.

    +9 more show less

    • Adds AWS Cognito Access Token detector for AWS Cognito User Pool access tokens.
    • Adds OpenAI Access Token detector for OpenAI platform access tokens.
    • Adds Vercel OIDC Token detector for Vercel workload-identity tokens.
    • Adds OpenCode API Key detector for OpenCode API keys.
    • Adds Supabase Service Role JWT checker for Supabase service_role JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage..
    • Improves precision for github_oauth_token, generic_password, base64_generic_high_entropy_secret, and generic_high_entropy_secret detectors: values that fail format validation are no longer reported.
    • Expands generic_password detector to ignore passwords in public proxy-subscription configs (shadowsocks/vmess/vless/trojan/hysteria URIs, Telegram MTProto links, clash/mihomo node lists).
    • Expands generic_encryption_key detector to ignore Talend encrypted passwords (enc:system|routine.encryption.key.vN:...).
    • Improves recall for PostgreSQL credential detectors: usernames containing dashes (e.g. workflow-prod-user) are now matched, and the username length bound is raised from 20 to 30 characters.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Amadeus OAuth credentials detector and checker have been disabled as the Amadeus self-service API has been discontinued.
77. Catch credential stealers on your endpoint fleet (2026-08-10) Aug 10, 2026 · issue 042

    GitGuardian adds honeytoken-based endpoint intrusion detection via ggshield honeytoken plant, plus API-based PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it./SAT creation.

    └──▷ TRY IT
    Plant a honeytoken decoy credential on a developer machine — run once per endpoint via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. job or manually to activate tripwire detection.
    copy

    $ ggshield honeytoken plant

    • New ggshield honeytoken plant command plants a decoy AWS credential on developer endpoints to detect credential-stealing malware the moment it reads the file.
    • New Honeytoken protection card in the Endpoints dashboard reports fleet-wide coverage percentage and lists endpoints not yet protected.
    • Adds Public API endpoints to create Personal Access Tokens (PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) and Service Account Tokens (SATs) programmatically, enabling automated token rotation workflows; tokens created via the API must have a finite TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit..

    3 details in Everything

78. api-docs-7c9d3e1aa9a9 Aug 5, 2026 · issue 036

    GitGuardian API gains a token-creation endpoint that lets personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. and service account tokens mint new tokens programmatically.

    • Adds a Create API Token endpoint that mints a new personal_access_token or service_account token programmatically; the clear-text token value is returned only in the creation response and cannot be retrieved again via list or retrieve endpoints.
    • Enforces scope delegation on token creation: the scopes granted to the new token must be a subset of the calling token's scopes, and some scopes implicitly include others, so the returned token may carry more scopes than explicitly requested.
    • Rejects creation when the name is already used by an active token of the same type, when the workspace has reached its active-token limit, or when the requested lifetime exceeds the workspace policy maximum.
    • Requires no particular scope on the calling token — any valid token can call this endpoint, making it self-service for both members and service accounts.

    4 details in Everything

79. docs update Aug 4, 2026 · issue 035

    GitGuardian adds 4 new detectors, 2 new validity checkers, and expands HTML/Markdown scanning to npm, GitHub, and Slack tokens

    • New Azure Immersive Reader Key detector added.
    • New DashScope Coding Plan API Key detector added for Alibaba Cloud Model Studio (Qwen / DashScope) Coding Plan API keys.
    • New DashScope Token Plan API Key detector added for Alibaba Cloud Model Studio (Qwen / DashScope) Token Plan API keys.
    • New Prefect Cloud API Key detector added.
    • New validity checker for Alibaba Cloud Keys (IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access.) — requires username and host to be present.

    +7 more show less

    • New validity checker for GitLab Deploy Tokens — requires username and host to be present.
    • HTML and Markdown file scanning extended to npm, GitHub Personal Access Token, GitHub OAuth Token, GitHub App, and Slack Application Credentials tokens.
    • Generic High Entropy Secret detector broadened to detect more credential key names: access, app, vault, sign, dev, prod, and staging key prefixes; encryption keys are now handled by generic_encryption_key.
    • Okta host matching updated to cover regional and preview host domains, raising precision from ~0% to ~100% on a manually reviewed subset.
    • auth0_keys detector now requires a JSON response to mark secrets valid, preventing non-Auth0 domains from being reported as valid.
    • microsoft_power_apps_webhook detector now treats WorkflowNotFound responses from deleted flows as invalid.
    • bearer_token detector now drops expired JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. tokens, reducing false positives.

    12 details in Everything

80. docs update Aug 4, 2026 · issue 035

    GitGuardian adds ggshield machine report command to scan and submit results in a single step for scheduled jobs.

81. changelog Jul 31, 2026 · issue 031

    GitGuardian adds a dedicated GitHub Check Runs dashboard page, bulk perimeter actions, and Bitbucket source health management.

    └──▷ HOW TO FIND IT
    Bulk-unmonitor a set of deprecated sources and remove them from all team assignments in one operation.
    📍On the perimeter page, select the sources you want to remove from monitoring, then choose Unmonitor from the bulk actions menu. Confirm the popup that appears when more than 30 sources are selected.
    • New dedicated GitHub Check Runs page in the dashboard lets security teams browse all check run statuses, filter by repository/status/date, view KPI metrics, re-run or skip checks, and jump directly to linked incidents — without leaving GitGuardian.
    • Fine-grained GitHub personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. can now be used to monitor private members of a GitHub organization (previously only classic tokens were supported).
    • Customizable column display on the perimeter table lets users surface the source attributes most relevant to their workflow.
    • Bulk actions on perimeter sources now support Monitor, Unmonitor, and Assign Team operations on multiple sources at once, with a confirmation popup when more than 30 sources are selected.
    • Historical scans now have a dedicated tab on the perimeter page for tracking past and in-progress scan statuses in one place.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Display as Tree view has been removed from integration source pages; only the Display as List view remains.
82. docs update Jul 28, 2026 · issue 028

    GitGuardian roadmap adds Honeytoken multi-cloud/CI/CD/vault support, Slack App with interactive actions, Teams DMs, and an Amazon Kiro integration.

    • Adds Endpoint Breach Detection view, shifting endpoint UX toward asset protection and attack detection.
    • Surfaces Non-Human Identity policy breaches (overprivilege, stale identities, cross-environment usage) as actionable incidents with lifecycle tracking.
    • Replaces the Slack webhook notifier with a native Slack App that threads incident events under a single parent message per incident.
    • Adds interactive Slack Block Kit buttons (Resolve / Ignore) so developers can act on incidents directly from the Slack notification card.
    • Delivers incident notifications as Slack direct messages to the responsible developer, with configurable Thread / DM / Both delivery mode and a fallback user.

    +8 more show less

    • Delivers incident notifications as Microsoft Teams direct messages to the responsible developer, with configurable Channel / DM / Both delivery mode and a fallback user.
    • Adds a GitGuardian Power for Amazon Kiro with secret-detection skill guidelines, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. configuration, and hooks for AI-assisted development.
    • Expands Honeytoken support beyond AWS to GCP service account JSON keys and Azure AD client secrets.
    • Adds new Honeytoken deception primitives: fake service endpoints, database credentials, and SaaS API keys.
    • Enables Honeytoken injection into CI/CD runners to detect supply-chain attacks that exfiltrate environment variables.
    • Enables planting Honeytokens inside HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault as a second dissemination surface.
    • Adds a unified protection coverage dashboard across all asset types: endpoints, vaults, CI/CD, cloud accounts, and repos.
    • Introduces an Attack Detection incident type that surfaces Honeytoken triggers as high-priority alerts with attacker forensics.

    13 details in Everything

83. docs update Jul 28, 2026 · docs issue 004

    GitGuardian roadmap adds Honeytoken multi-cloud/CI/CD/vault support, Slack App with interactive actions, Teams DMs, and an Amazon Kiro integration.

    • Adds Endpoint Breach Detection view, shifting endpoint UX toward asset protection and attack detection.
    • Surfaces Non-Human Identity policy breaches (overprivilege, stale identities, cross-environment usage) as actionable incidents with lifecycle tracking.
    • Replaces the Slack webhook notifier with a native Slack App that threads incident events under a single parent message per incident.
    • Adds interactive Slack Block Kit buttons (Resolve / Ignore) so developers can act on incidents directly from the Slack notification card.
    • Delivers incident notifications as Slack direct messages to the responsible developer, with configurable Thread / DM / Both delivery mode and a fallback user.

    +8 more show less

    • Delivers incident notifications as Microsoft Teams direct messages to the responsible developer, with configurable Channel / DM / Both delivery mode and a fallback user.
    • Adds a GitGuardian Power for Amazon Kiro with secret-detection skill guidelines, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. configuration, and hooks for AI-assisted development.
    • Expands Honeytoken support beyond AWS to GCP service account JSON keys and Azure AD client secrets.
    • Adds new Honeytoken deception primitives: fake service endpoints, database credentials, and SaaS API keys.
    • Enables Honeytoken injection into CI/CD runners to detect supply-chain attacks that exfiltrate environment variables.
    • Enables planting Honeytokens inside HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault as a second dissemination surface.
    • Adds a unified protection coverage dashboard across all asset types: endpoints, vaults, CI/CD, cloud accounts, and repos.
    • Introduces an Attack Detection incident type that surfaces Honeytoken triggers as high-priority alerts with attacker forensics.

    13 details in Everything

84. docs update Jul 28, 2026 · issue 028

    GitGuardian Self-Hosted 2026.7.0 adds Public Monitoring, native Gerrit scanning, Smart Notifiers, 9 new detectors, and an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server deployment.

    └──▷ USE IT
    Enable Public Monitoring on a self-hosted instance to process public perimeter scanning queues.
    yaml copy

    celeryWorkers:
      public-monitoring:
        enabled: true

    Deploy the GitGuardian MCP server in your cluster (beta) via Helm values.
    yaml copy

    mcpServer:
      enabled: true

    • Adds Public Monitoring to self-hosted instances (license-gated): monitor public perimeter for secret leaks and route incidents through custom webhooks, Slack, Microsoft Teams, ServiceNow ticketing, and severity-filtered email alerts via the new celeryWorkers.public-monitoring worker.
    • Adds native Gerrit VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. source with full historical scanning, real-time detection via webhook plugin, and read-replica support for cloning.
    • Adds Smart Notifiers: define per-channel filtering rules so alerts, tickets, or emails are only created for incidents matching severity, validity, secret type, or GitGuardian tag — across internal and public monitoring.
    • GitHub check runs now scan oversized pull requests by cloning the repository branch instead of calling the GitHub API commit-by-commit, and can skip merge commits; thresholds and rate-limit behavior are configurable from the admin area GitHub preferences.
    • Adds Gateway API routing: route external traffic through the Kubernetes Gateway API instead of the legacy Ingress resource, with HPA or KEDA autoscaling for webapps.

    +6 more show less

    • Adds 9 new detectors (Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, Azure Maps, Azure Mixed Reality, Azure Service Bus, Azure Quantum, Azure Bot Direct Line) and 2 new checkers (Gemfury Deploy/Push Token, Gemfury Full Access Token).
    • Jira Notifier now exposes remediation guidance and detector-specific links as assignable fields in the ticket description template.
    • Custom Sources (BYOS) now support a scan-with-validated-detectors-only option.
    • Daily analytics job can now write Spark scratch data to a dedicated ephemeral volume, preventing failures from node ephemeral-storage limits on large workspaces.
    • Adds opt-in mcpServer Helm deployment to run the GitGuardian MCP server in-cluster (currently in beta).
    • Incident assignment now auto-grants access to the assignee.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !logCollector.collectMigrationLogs is enabled by default and requires Kubernetes 1.29 or later; on older clusters, set logCollector.collectMigrationLogs: false before upgrading.
    • !Developer Endpoint Protection is not functional on self-hosted instances in 2026.7.0; instances relying on Endpoint Protection should hold off on upgrading.
85. docs update Jul 28, 2026 · docs issue 004

    GitGuardian Self-Hosted 2026.7.0 adds Public Monitoring, native Gerrit scanning, Smart Notifiers, 9 new detectors, and an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server deployment.

    └──▷ USE IT
    Enable Public Monitoring on a self-hosted instance to process public perimeter scanning queues.
    yaml copy

    celeryWorkers:
      public-monitoring:
        enabled: true

    Deploy the GitGuardian MCP server in your cluster (beta) via Helm values.
    yaml copy

    mcpServer:
      enabled: true

    • Adds Public Monitoring to self-hosted instances (license-gated): monitor public perimeter for secret leaks and route incidents through custom webhooks, Slack, Microsoft Teams, ServiceNow ticketing, and severity-filtered email alerts via the new celeryWorkers.public-monitoring worker.
    • Adds native Gerrit VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. source with full historical scanning, real-time detection via webhook plugin, and read-replica support for cloning.
    • Adds Smart Notifiers: define per-channel filtering rules so alerts, tickets, or emails are only created for incidents matching severity, validity, secret type, or GitGuardian tag — across internal and public monitoring.
    • GitHub check runs now scan oversized pull requests by cloning the repository branch instead of calling the GitHub API commit-by-commit, and can skip merge commits; thresholds and rate-limit behavior are configurable from the admin area GitHub preferences.
    • Adds Gateway API routing: route external traffic through the Kubernetes Gateway API instead of the legacy Ingress resource, with HPA or KEDA autoscaling for webapps.

    +6 more show less

    • Adds 9 new detectors (Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, Azure Maps, Azure Mixed Reality, Azure Service Bus, Azure Quantum, Azure Bot Direct Line) and 2 new checkers (Gemfury Deploy/Push Token, Gemfury Full Access Token).
    • Jira Notifier now exposes remediation guidance and detector-specific links as assignable fields in the ticket description template.
    • Custom Sources (BYOS) now support a scan-with-validated-detectors-only option.
    • Daily analytics job can now write Spark scratch data to a dedicated ephemeral volume, preventing failures from node ephemeral-storage limits on large workspaces.
    • Adds opt-in mcpServer Helm deployment to run the GitGuardian MCP server in-cluster (currently in beta).
    • Incident assignment now auto-grants access to the assignee.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !logCollector.collectMigrationLogs is enabled by default and requires Kubernetes 1.29 or later; on older clusters, set logCollector.collectMigrationLogs: false before upgrading.
    • !Developer Endpoint Protection is not functional on self-hosted instances in 2026.7.0; instances relying on Endpoint Protection should hold off on upgrading.
86. docs update Jul 28, 2026 · issue 028

    GitGuardian adds a dedicated Check Runs dashboard page, Bitbucket source health management, perimeter column customization, and bulk source actions.

    └──▷ HOW TO FIND IT
    Audit scan coverage and unblock a stalled pull request without leaving GitGuardian — find the failed check run, diagnose it, and re-run it from the dashboard.
    📍In the GitGuardian dashboard, open the Check Runs tab (under the relevant section). Filter by repository and status Failed, locate the check run tied to the blocked PR, then click Re-run to trigger a new scan directly from the list.
    Apply team assignment or monitoring status to a large batch of sources in one operation instead of editing each source individually.
    📍In the GitGuardian dashboard, navigate to the Perimeter page, select the sources you want to update (up to or exceeding 30 — a confirmation popup will appear for larger selections), then choose Monitor, Unmonitor, or Assign Team from the bulk actions menu.
    • New dedicated Check Runs page in the dashboard lets security teams browse all GitHub check run results (status, repo, commit SHA, PR, timing), filter by repository/status/date, re-run or skip checks, and jump directly to linked incidents — without switching to GitHub.
    • Fine-grained GitHub personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. can now be used to monitor private members of a GitHub organization (previously only classic tokens were supported) in the Public Perimeter view.
    • Perimeter table now supports column customization, letting users choose which source attributes are displayed to tailor the view to their workflow.
    • Bulk actions on perimeter sources now support Monitor, Unmonitor, and Assign Team operations on selected sources, with a confirmation popup when selecting more than 30 sources.
    • Historical scans now have their own dedicated tab on the perimeter page for tracking past and in-progress scans and their statuses.

    5 details in Everything

87. docs update Jul 28, 2026 · docs issue 004

    GitGuardian adds a dedicated Check Runs dashboard page, Bitbucket source health management, perimeter column customization, and bulk source actions.

    └──▷ HOW TO FIND IT
    Audit scan coverage and unblock a stalled pull request without leaving GitGuardian — find the failed check run, diagnose it, and re-run it from the dashboard.
    📍In the GitGuardian dashboard, open the Check Runs tab (under the relevant section). Filter by repository and status Failed, locate the check run tied to the blocked PR, then click Re-run to trigger a new scan directly from the list.
    Apply team assignment or monitoring status to a large batch of sources in one operation instead of editing each source individually.
    📍In the GitGuardian dashboard, navigate to the Perimeter page, select the sources you want to update (up to or exceeding 30 — a confirmation popup will appear for larger selections), then choose Monitor, Unmonitor, or Assign Team from the bulk actions menu.
    • New dedicated Check Runs page in the dashboard lets security teams browse all GitHub check run results (status, repo, commit SHA, PR, timing), filter by repository/status/date, re-run or skip checks, and jump directly to linked incidents — without switching to GitHub.
    • Fine-grained GitHub personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. can now be used to monitor private members of a GitHub organization (previously only classic tokens were supported) in the Public Perimeter view.
    • Perimeter table now supports column customization, letting users choose which source attributes are displayed to tailor the view to their workflow.
    • Bulk actions on perimeter sources now support Monitor, Unmonitor, and Assign Team operations on selected sources, with a confirmation popup when selecting more than 30 sources.
    • Historical scans now have their own dedicated tab on the perimeter page for tracking past and in-progress scans and their statuses.

    5 details in Everything

88. docs update Jul 28, 2026 · issue 028

    GitGuardian v2.167.0 adds 11 new secret detectors across Azure, AI/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., and dev tooling, plus new validity checkers for LiteLLM, Llama Cloud, New Relic, and npm.

    • Adds detector for LiteLLM API Key (without host capture).
    • Adds detector for Azure SQL Credentials (Assignment).
    • Adds detector for Azure Machine Learning keys.
    • Adds detector for Azure Video Indexer Key.
    • Adds detector for Azure Health Insights Key.

    +10 more show less

    • Adds detector for Azure Fluid Relay Key.
    • Adds detector for Apify Proxy Token.
    • Adds detector for DashScope API Key (signed/workspace Alibaba Cloud Model Studio / Qwen keys).
    • Adds detector for Authress Service Client Access Key.
    • Adds detectors for Gemfury Deploy Or Push Token Without Username and Gemfury Full Access Token Without Username.
    • Improves recall for Datadog API Key and Snyk Key detectors.
    • Adds validity checker for LiteLLM API Key Without Host with custom host support.
    • Adds validity checker for Llama Cloud API key.
    • Adds validity checker for New Relic APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. License Key.
    • Adds validity checkers for npm token and npm token (prefixed variant).

    15 details in Everything

89. docs update Jul 28, 2026 · docs issue 004

    GitGuardian v2.167.0 adds 11 new secret detectors across Azure, AI/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., and dev tooling, plus new validity checkers for LiteLLM, Llama Cloud, New Relic, and npm.

    • Adds detector for LiteLLM API Key (without host capture).
    • Adds detector for Azure SQL Credentials (Assignment).
    • Adds detector for Azure Machine Learning keys.
    • Adds detector for Azure Video Indexer Key.
    • Adds detector for Azure Health Insights Key.

    +10 more show less

    • Adds detector for Azure Fluid Relay Key.
    • Adds detector for Apify Proxy Token.
    • Adds detector for DashScope API Key (signed/workspace Alibaba Cloud Model Studio / Qwen keys).
    • Adds detector for Authress Service Client Access Key.
    • Adds detectors for Gemfury Deploy Or Push Token Without Username and Gemfury Full Access Token Without Username.
    • Improves recall for Datadog API Key and Snyk Key detectors.
    • Adds validity checker for LiteLLM API Key Without Host with custom host support.
    • Adds validity checker for Llama Cloud API key.
    • Adds validity checker for New Relic APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. License Key.
    • Adds validity checkers for npm token and npm token (prefixed variant).

    15 details in Everything

90. Track your GitHub check runs from the dashboard (2026-07-28) Jul 28, 2026 · issue 028

    GitGuardian adds a dedicated GitHub Check Runs dashboard page with filtering, KPIs, re-run controls, and incident linking.

    └──▷ HOW TO FIND IT
    Audit scan coverage and unblock a stuck pull request by finding and re-running a failed check run without leaving GitGuardian.
    📍In the dashboard, go to Perimeter › GitHub check runs. Filter by repository and set Status to Failed, locate the run for the relevant commit SHA, then click Re-run.
    Jump straight to remediation when a check run catches a secret, without switching to GitHub.
    📍In the dashboard, go to Perimeter › GitHub check runs. Find the check run with detected secrets, then click the linked incident to open the incident details and begin remediation.
    • New GitHub Check Runs page in the Perimeter section surfaces every check run with status, repository, commit SHA, pull request, and timing in one place.
    • Filter and search check runs by repository, status, or date — including workspaces with hundreds of thousands of runs.
    • KPI strip at the top of the Check Runs page summarizes activity to surface failures and trends at a glance.
    • Re-run or skip a check run directly from the dashboard without switching to GitHub.
    • Navigate from a check run directly to linked incidents when secrets are detected, enabling faster remediation.

    +2 more show less

    • Fine-grained GitHub personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. can now be used to monitor private members of a GitHub organization in the Public Perimeter (previously limited to classic tokens).
    • Sources health management extended to Bitbucket Cloud and Bitbucket Data Center: GitGuardian now auto-pauses ingestion on unreachable sources, auto-resumes on recovery, and surfaces actionable recovery steps.

    7 details in Everything

91. changelog Jul 23, 2026 · issue 023
    └──▷ HOW TO FIND IT
    Loop in a teammate or team directly on an incident without leaving GitGuardian — they receive an email linking straight to the incident.
    📍In any incident, open the Notes or Feedback panel, type @ and select a member (@name) or a team (@team-name) from the searchable list, then submit.
    Filter the incident list to set aside noise from archived or deleted sources, then save it as a persistent view.
    📍On the Perimeter page or Incident list, open the source status filter and select Archived or Deleted, then save as a view.
    Reduce false positives on a Custom Source install by restricting scans to detectors that can actually verify secret validity.
    📍In the Custom Source install settings, enable the 'use only detectors with validators' option for the target source.
    • Adds @mention support in incident notes and feedback — type @name or @team-name to notify individual members or entire teams via email, linked directly to the incident.
92. docs update Jul 23, 2026 · docs issue 004
    └──▷ HOW TO FIND IT
    Loop in a teammate or team directly on an incident without leaving GitGuardian — they receive an email linking straight to the incident.
    📍In any incident, open the Notes or Feedback panel, type @ and select a member (@name) or a team (@team-name) from the searchable list, then submit.
    Filter the incident list to set aside noise from archived or deleted sources, then save it as a persistent view.
    📍On the Perimeter page or Incident list, open the source status filter and select Archived or Deleted, then save as a view.
    Reduce false positives on a Custom Source install by restricting scans to detectors that can actually verify secret validity.
    📍In the Custom Source install settings, enable the 'use only detectors with validators' option for the target source.
    • Adds @mention support in incident notes and feedback — type @name or @team-name to notify individual members or entire teams via email, linked directly to the incident.
93. docs update Jul 21, 2026 · issue 021

    GitGuardian roadmap adds incident routing, Sonatype Nexus scanning, and full encoded-secret insights

    • New incident routing (phase 1) automatically assigns a Lead (accountable) and Participants (doing the work) to every incident at creation.
    • Supports scanning Sonatype Nexus Repository package and container image registries for hardcoded secrets.
    • Displays full encoded insights — persists and surfaces analyzer feedback including decoded base64 and JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. detector results.

    3 details in Everything

94. docs update Jul 21, 2026 · issue 021

    GitGuardian adds @mentions in incident notes, perimeter source status filtering, and oversized PR scanning for Business plans.

    └──▷ HOW TO FIND IT
    Loop in a teammate or team on a live incident without leaving the platform — replaces the need to ping via Slack or email.
    📍In the console, open any incident, add a note or feedback, type @ and select a member (@name) or team (@team-name) from the searchable list. They receive an email linking directly to the incident. Manage mention email preferences under notification settings.
    Filter the incident list to ignore noise from archived or deleted sources by saving a perimeter view filtered by source status.
    📍In the console, go to the Perimeter page or Incident list, filter by source status (e.g. Archived or Deleted), then save the filtered view for ongoing use.
    Cut false-positive noise on a Custom Source install by restricting scans to only secrets whose detector supports validity verification.
    📍In the console, go to your Custom Source (BYOS) install settings and enable the 'use only detectors with validators' option for the desired install.
    • Adds @mentions in incident notes and feedback — type @name or @team-name to notify individuals or entire teams via email, linking directly to the incident; works on both Internal and Public Monitoring incidents.
    • Extends source health management (auto-pause, auto-resume, and actionable recovery steps) to ServiceNow, JFrog Container Registry, JFrog Package Registry, and Microsoft OneDrive.
    • Introduces perimeter source status indicators (Monitored, Unmonitored, Unreachable, Archived, Deleted) filterable from the perimeter page and incident list, with saveable views.
    • Enables scanning of oversized pull requests (>200 commits, >60,000 files, or >300,000 lines changed) on the Business plan via repository branch cloning, bypassing GitHub API rate limits.
    • Adds opt-in 'use only detectors with validators' option for Custom Source (BYOS) installs, filtering out unverifiable matches before validity checks run to reduce noise.

    +1 more show less

    • Logs monitoring setting changes (e.g. toggling automatic monitoring on/off) in the audit trail.

    6 details in Everything

95. Mention members and teams in incident notes (2026-07-20) Jul 20, 2026 · issue 021

    GitGuardian adds @mention notifications in incident notes, source health for new integrations, and oversized PR scanning on Business plan.

    └──▷ HOW TO FIND IT
    Loop in a teammate or an entire team on a critical incident without leaving GitGuardian.
    📍In the console, open any incident › add a note or feedback › type @ and select a member (@name) or team (@team-name) from the searchable list. The mentioned users receive an email linking directly to the incident.
    Filter the incident list to only incidents from active sources, setting aside noise from archived or deleted ones.
    📍In the console, go to the Perimeter page or Incident list › open the source status filter › select Monitored (or exclude Archived / Deleted) › save as a view for reuse.
    Reduce false positives on a Custom Source install by limiting scans to detectors that can verify secret validity.
    📍In the console, go to the Custom Source install settings › enable 'use only detectors with validators' › save. Subsequent scans on that source will drop matches whose detector has no validator before the validity check runs.
    • Adds @mention support in incident notes and feedback — type @ to tag a member by @name or an entire team by @team-name, triggering email notifications that link directly to the incident.
    • Extends source health management (auto-pause, auto-resume, and recovery guidance) to ServiceNow, JFrog Container Registry, JFrog Package Registry, and Microsoft OneDrive sources.
    • Introduces per-source status indicators (Monitored, Unmonitored, Unreachable, Archived, Deleted) on the perimeter page and incident list, with filterability and saveable views.
    • Enables scanning of oversized pull requests (>200 commits, >60,000 files, or >300,000 lines changed) via repository cloning on the Business plan, bypassing GitHub API rate limits.
    • Adds opt-in 'use only detectors with validators' option for Custom Source (BYOS) installs, dropping unverifiable matches before validity checks to reduce noise.

    5 details in Everything

96. Generic Detectors landing on your non-VCS sources, powered by the False Positive Remover (2026-07-07) Jul 7, 2026 · issue 014

    GitGuardian extends Generic Password and High Entropy Secret detection to Confluence, Jira, Slack, and Teams — with AI false-positive filtering built in.

    └──▷ HOW TO FIND IT
    Review or toggle AI-powered false-positive filtering for non-code sources after it is enabled by default on Business accounts.
    📍In the GitGuardian console, go to Settings › AI settings and confirm that AI features (including the False Positive Remover) are enabled for your non-code source integrations.
    • Adds Generic Password and Generic High Entropy Secret detection to non-code sources including Confluence, Jira, Slack, Microsoft Teams, and others — matching the coverage already available for VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures..
    • Extends the False Positive Remover (LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-based model) to non-code source findings, automatically tagging 25–40% of generic findings as false positives before they surface in the dashboard.
    • Adds remediation guidance content and detector-specific links as assignable metadata fields in the Jira Notifier integration ticket description template.

    3 details in Everything

97. ServiceNow Integration: Event Group Selection, Public Monitoring & Honeytoken Support (2026-06-30) Jun 30, 2026 · issue 014

    GitGuardian's ServiceNow integration gains Public Monitoring, Honeytoken support, and granular event subscription filters.

    └──▷ TRY IT
    Retrieve the activity log for a specific secret incident via the Public API to feed into an automation or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. workflow.
    copy

    $ curl -s -H 'Authorization: Token <your_api_token>' 'https://api.gitguardian.com/v1/incidents/<incident_id>/activity' | jq .

    Enable Honeytoken and Public Monitoring event routing in a new ServiceNow integration so decoy and perimeter alerts land in the same ticketing workflow as internal incidents.
    📍In the GitGuardian dashboard, go to Integrations › ServiceNow › Configure, then under Event Groups enable Public monitoring and Honeytoken events. In the Notify when section, select the additional events (e.g. Incident ignored, Incident resolved) to be posted as comments on the ticket.
    • Adds Event Group Selection to the ServiceNow integration: choose to route Internal Monitoring, Public Monitoring, or Honeytoken incidents into ServiceNow tickets.
    • Supports Public Monitoring in ServiceNow, so secrets exposed on public sources flow into the same remediation workflow as internal incidents.
    • Supports Honeytoken events in ServiceNow, bringing decoy-token alerts into the ticketing and remediation workflow.
    • New Notify when section enables granular event subscription: the New incident detected event creates the ticket, while additional selected events are posted as comments, keeping full incident history in one place.
    • Adds severity and risk score information to incident notifications in Slack and Microsoft Teams.

    +3 more show less

    • Adds source health management for Confluence Cloud, Slack, Gerrit, and Microsoft SharePoint Online: GitGuardian pauses ingestion on unreachable sources and auto-resumes once health is restored, surfacing an actionable recovery step.
    • Adds a new Public API endpoint to retrieve the activity log of a secret incident, enabling automation and monitoring workflows.
    • Adds support for a second AWS Marketplace seller account (GitGuardian Inc., US entity) so US customers can transact through the US listing.

    8 details in Everything

98. Smart Notifiers - filter alerts, tickets, and emails by incident criteria (2026-06-19) Jun 19, 2026 · issue 014

    Smart Notifiers lets GitGuardian alert only on incidents that match severity, ML risk, validity, or secret type — no middleware needed.

    └──▷ HOW TO FIND IT
    Route only high-severity, valid secrets to a Slack channel — eliminating noise from informational or unverified incidents.
    📍In the console, go to Alerting & Notifications › Slack notifier settings, then add a filter rule: set Severity to High or Critical and Validity to Valid. Save the rule to apply it to that channel.
    Prevent false-positive check run failures caused by secrets merged in from the target branch during large PRs.
    📍In the console, go to Integrations › GitHub › Check Runs settings and enable Skip merge commits to restrict flagging to secrets introduced on the PR branch only.
    Unlink a runaway or mistakenly created Jira ticket from an incident without deleting the external ticket.
    📍In the console, open the incident detail page, locate the linked Jira ticket section, and click Dissociate ticket to remove the association while keeping the Jira issue intact.
    • Adds Smart Notifiers: per-channel filtering rules for webhooks, Slack, and Microsoft Teams alerts based on severity, ML risk score, validity, secret type, or GitGuardian tag across internal and public monitoring.
    • Enables email alerting to filter public monitoring incidents by severity.
    • Adds sources health management for Confluence Data Center and Microsoft Teams: auto-pauses ingestion on unreachable sources and auto-resumes when health is restored.
    • Expands Overview analytics to include Non-Human Identity (NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.) and Public Monitoring data.
    • New GitHub check run setting to skip merge commits in pull request scans, flagging only secrets introduced on the PR branch.

    +6 more show less

    • GitHub check runs now skip scans on pull requests exceeding a configured size limit to protect the shared GitHub API rate limit.
    • Enables dissociation of a Jira or ServiceNow ticket from an incident directly on the incident detail page without deleting the external ticket.
    • Adds support for the Feedback Received event in ServiceNow event-based notifications.
    • Adds ability to filter incidents by closure reason.
    • Increases character limit for secret value search on the incidents page to support longer secrets such as large JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage..
    • Supports read-only tokens for GitLab group hook installations, with manual webhook creation instructions surfaced when needed.

    11 details in Everything

99. Smart Notifiers - filter alerts, tickets, and emails by incident criteria (2026-06-19) Jun 19, 2026 · release notes

    Smart Notifiers lets you filter alerts by criteria; improved scan coverage and ticketing controls

    • config rules for Smart Notifiers allow filtering notifications by severity, ML risk score, validity, secret type, or GitGuardian tag for custom webhook, Slack, Microsoft Teams, and email channels.
    • Incidents page now filters by closure reason via the UI filter options.
    • GitHub check runs gain a new setting to skip merge commits in pull request checks.
    • Large GitHub pull requests can now be skipped based on a configured size limit to protect API rate limits.

    4 details in Everything

100. Open-source agent skills - teach AI coding assistants to use ggshield (2026-05-21) May 21, 2026 · release notes

     GitGuardian SaaS adds agent skills for Claude Code and Cursor to invoke ggshield scanning and remediation natively within AI coding assistants.

     └──▷ TRY IT
     Install the agent skill so Claude Code can scan secrets when requested by the developer.
     copy

     $ /plugin install ggshield

     Enable automatic scanning of all AI agent interactions by installing the ggshield hook for Claude Code.
     copy

     $ ggshield install -t claude-code

     Configure Cursor rules to expose the ggshield workflow for on-demand agent use.
     📍Drop the provided skills into your .cursor/ directory
     • Adds gitguardian/agent-skills repository providing Claude Code plugin and Cursor rules to teach AI assistants how to use ggshield
     • Enables optional ggshield install -t claude-code hook to automatically scan every prompt, tool call, and output inside the agent
     • Jira Cloud integration now uses scheduled recurrent scans instead of inbound webhooks for monitoring

     3 details in Everything

101. A smarter search bar - find incidents by value, author, file path, or in plain English (2026-05-20) May 20, 2026 · release notes

     GitGuardian SaaS adds value/author/path/NL search and Teams regression notifications to the UI

     └──▷ HOW TO FIND IT
     Find incidents involving a specific developer fragment like @contractor.com
     📍Type @contractor.com into the main incident search bar.
     Use AI to filter for unassigned critical cloud incidents via natural language
     📍Ensure AI Filters are enabled in workspace settings, then type "Open critical unassigned incidents related to cloud providers" into the search bar.
     • Adds natural language search (AI Filters) to the incident search bar, allowing full-sentence queries that compose with structured filters.
     • Adds search by secret value, commit author, file path, and source name directly in the main incident search bar.

     2 details in Everything

102. Enhanced Microsoft Teams Notifications - Public Monitoring, Internal Monitoring & Honeytoken Alerts (2026-04-29) Apr 29, 2026 · release notes

     Enhanced Microsoft Teams notifications for all incident events, public monitoring, and honeytokens; new API health checks and archived source filters

     • Microsoft Teams config supports granular subscription to specific event types (resolution, assignment, status changes, comments, access control, sharing) per channel
     • Microsoft Teams notifications now include Public Monitoring incidents alongside internal monitoring alerts
     • Microsoft Teams notifications now support Honeytoken Alerting events, previously only available via custom webhooks and email
     • GET /rest/sources returns provider_metadata.archived field for GitHub sources and accepts provider_metadata_archived=true filter
     • GET /rest/incidents accepts only_on_provider_archived_sources=true filter to focus on incidents from archived sources

     5 details in Everything

103. Attachment scanning now covers all Jira and Confluence variants! (2026-04-27) Apr 27, 2026 · release notes

     Attachment scanning adds support for Jira and Confluence Cloud and Data Center sources.

     └──▷ HOW TO FIND IT
     Reinstall Jira or Confluence integrations to grant new read:attachment:jira or readonly:content.attachment:confluence scopes required for attachment scanning.
     📍Go to Settings › Integrations › Sources and click Reinstall for each affected Jira/Confluence source.
     • Removes deprecated Honeytoken Labels API endpoints, requiring migration to the Custom Tags API.

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Honeytoken Labels API endpoint is removed; use the Custom Tags API instead.
104. GitGuardian now listed on the Slack Marketplace, packed with new capabilities! (2026-04-23) Apr 23, 2026 · release notes

     GitGuardian Slack app now on Marketplace with channel selection, attachment scanning, and Jira dynamic variables.

     └──▷ HOW TO FIND IT
     Install GitGuardian in the US region via the app directory.
     📍Open https://slack.com/apps? Referring to the GitGuardian (US) listing in the Slack Marketplace.
     Use dynamic variables to create a Jira ticket that includes the secret type and source name.
     📍When configuring the Jira Integration in Settings › Integrations, use {secretType} and {sourceName} in Labels or Summary fields.
     Monitor specific public channels instead of all of them during Slack setup.
     📍During the Slack app installation flow, use Channel selection at setup time to choose which public channels to monitor.
     • Slack app is officially listed on the Slack Marketplace in both US and EU regions.
     • Channel selection at setup time allows users to choose which public channels to monitor during installation instead of the app automatically joining every public channel.
     • File attachment scanning detects secrets hiding in file attachments dropped in channels and messages alongside text-based messages.
     • Interactive messages (Beta) posts a threaded response directly in the original conversation with details about the finding and quick actions, including the ability to ignore low-risk incidents without leaving Slack.
     • Enhanced privacy controls redact private channel names for users who don't have access to those channels in Slack and display a privacy information banner during setup.

     +1 more show less

     • Jira Integration now supports dynamic variables (e.g., {secretType}, {sourceName}, {sourceType}) across all Jira fields — including Labels, Summary, Priority, and custom fields — not just the description.

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !If you previously covered your Slack Perimeter with GitGuardian, you will need to reinstall your Slack App using the same procedure.
105. Monitor your Gerrit repositories (2026-04-20) Apr 20, 2026 · release notes

     GitGuardian adds native Gerrit VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. integration with read replica support

     • Adds native Gerrit VCS source integration for secrets detection in enterprise code review workflows.
     • Enables read replica configuration to point GitGuardian to a secondary server for cloning operations, reducing load on the primary Gerrit instance.
     • Introduces support for the webhook plugin to enable real-time secret detection as commits are pushed to Gerrit repositories.

     3 details in Everything

106. Flag admin and overprivileged NHIs across AWS, Entra, and Okta Apr 16, 2026 · release notes

     New NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. admin/overprivilege detection, policy, badge, severity bump, and privacy mode scope

     • Identity level: Admin badge marks NHIsNHIsA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. with admin permissions (AWS AdministratorAccess, Entra Global Administrator, Okta Super Admin) in inventory and detail views
     • New Overprivileged Identity policy flags NHIs granted broader permissions than used
     • Admin NHI policy breaches automatically bumped one severity level higher (capped at critical)
     • Workspace-level Privacy Mode restricts plaintext secret visibility to managers or owners only
     • Public API now exposes the list of captured audit log event types

     5 details in Everything

107. Control team access to any Internal Monitoring source type Apr 13, 2026 · release notes

     Team perimeter access control now extends to all non-VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. integrations and BYOS sources.

     • team perimeter configuration now scopes internal incident access for container registries, messaging (Slack, Microsoft Teams), documentation/file storage (Confluence, SharePoint Online, OneDrive), ticketing (Jira, ServiceNow), package registries, and Bring Your Own Sources
     • Managers can add specific sources to a team's perimeter via Settings > User management > Teams using the Add sources option in the perimeter section

     2 details in Everything

108. Secret scanning for AI coding tools Apr 10, 2026 · release notes

     ggshield 1.49.0 adds real-time secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. hooks for Cursor, Claude Code, and GitHub Copilot

     • New ggshield install -t <tool> -m global command to configure real-time AI coding assistant hooks
     • Added GET /v1/severity-rules endpoint to list severity rules programmatically
     • Public API now supports privacy mode to control secret content visibility in retrieved secrets

     3 details in Everything

109. Email Verification for Sensitive Actions (MFA) Mar 24, 2026 · release notes

     GitGuardian adds email MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for login/sensitive actions and new API/location fields

     • Adds POST /v1/scan/create-incidents endpoint support for optional location.url field to link scanned documents back to their origin
     • Personal Access Tokens (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) and Service Account Tokens (SAT) now use an improved v2 format with gg_pat_ and gg_sat_ prefixes

     2 details in Everything

110. Publicly leaked tag and exposure detail in internal incidents Mar 10, 2026 · release notes

     GitGuardian SaaS introduces consolidated Publicly leaked tag and new Public exposure property for internal monitoring incidents.

     • Adds new Public exposure property with categories: Source is publicly visible, Has linked public incident, Found outside perimeter
     • Introduces default saved view Public exposure and dedicated column for filtering and viewing exposure details

     2 details in Everything

111. GitGuardian Is Now on the Okta Integration Network Mar 6, 2026 · release notes

     GitGuardian adds Okta Integration Network support for SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning

     • Adds Okta-verified app integration on the Okta Integration Network for streamlined identity management.
     • Enables One-click SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration via the Okta app catalog without custom SAML apps.
     • Supports automatic user lifecycle management through built-in SCIM provisioning (create, update, deactivate).
     • Adds Group Push capability to sync Okta groups and memberships directly into GitGuardian teams.
     • Supports both SP-initiatedSP-initiatedA SAML or OAuth/OIDC login flow where the Service Provider redirects the user to an Identity Provider to authenticate, rather than the IdP pushing an assertion unprompted; tools use it to trigger SSO from their own login page. and IdP-initiated SSOIdP-initiated SSOA single sign-on flow where the identity provider redirects an already-authenticated user directly to a service provider without the service provider first requesting authentication, removing the need for a separate login prompt. flows from the GitGuardian dashboard or Okta portal.

     +1 more show less

     • Introduces Just-in-Time provisioning for new users on first login, independent of SCIM status.

     6 details in Everything

112. Red Hat Quay Integration: Your Enterprise Images, Under Watch Mar 5, 2026 · release notes

     GitGuardian SaaS adds Red Hat Quay integration and a public API for egress IPs

     • Adds Red Hat Quay container registry integration to Settings > Integrations > Sources for scanning image layers in both quay.io and self-hosted instances
     • Adds public API endpoint to retrieve GitGuardian's egress IP addresses in CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. notation
     • Enables OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. authentication for the Red Hat Quay integration with read-only access

     3 details in Everything

113. JFrog Artifactory Package Registries: Secrets Hide in Your Packages Too Mar 3, 2026 · release notes

     GitGuardian adds JFrog Artifactory package registry integration for secrets detection in build artifacts.

     • Adds JFrog Package Registries integration to the Package registries section under Settings > Integrations > Sources
     • Adds PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. scope restriction setting in Security Settings, allowing workspace managers to limit members to specific scopes like Scan only
     • Adds customizable session duration setting in Authentication Settings for automatic dashboard logout
     • Adds filename and line number template options in Jira ticketing templates
     • Adds System theme mode option in Dashboard that matches OS light/dark preference

     +1 more show less

     • Adds feedback content (remarks) to Slack and Webhook alert payloads for monitoring incidents

     6 details in Everything

114. Ownership - Assign Accountability for Non-Human Identities Feb 11, 2026 · release notes

     GitGuardian adds Ownership for Non-Human Identities with owner assignment, suggested owners, and Owner column/filter in NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems..

     • Adds Ownership capability in NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. Governance to assign and track responsibility for each Non-Human Identity.
     • Adds automatic suggested owners based on integrated source data and secret incidents.
     • Adds an Owner column in the NHI inventory view showing responsible identities.
     • Adds ability to add, edit, or remove owners at any time from an NHI's detail view for workspace members and external users identified by email.
     • Adds filtering capability by owner (e.g., "identities with no owner" or "owned by my team") in the NHI inventory.

     5 details in Everything

115. Night Owl Mode: Improved UI + Dark Theme Feb 2, 2026 · release notes

     GitGuardian adds Dark Mode UI and incident API external ticket fields

     • Account → Interface → Theme dropdown allows per-user selection of Light or Dark theme to reduce eye strain during late-night incident response.
     • Incidents API responses now include external ticket information for Jira and ServiceNow integrations.
     • Analytics period selector expanded to include Last 30/60/90 days and Previous month/quarter/year ranges.

     3 details in Everything

116. Unified Identity Governance for Entra & AWS IAM Jan 22, 2026 · release notes

     GitGuardian expands NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. to Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. and AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. with unified identity mapping, risk scoring, and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication.

     • Expands NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. Governance integrations for Microsoft Entra ID and AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. with an enriched graph of identities, policies, and secrets.
     • Introduces automatic risk criticality scoring to surface high-impact threats like leaked credentials and orphaned accounts
     • Enables credential-free, short-lived token-based access via OIDC for the new identity integrations

     3 details in Everything

117. More NHI Integrations - Datadog, Snowflake, Okta, and Auth0 Dec 31, 2025 · release notes

     Release expands non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. (NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.) governance capabilities by enabling enumeration of service accounts and API keys across four critical infrastructure platforms: Datadog, Snowflake, Okta, and Auth0.

118. Analytics Overview - Executive Bird's-Eye View of Security Posture Dec 19, 2025 · release notes

     New Analytics Overview dashboard for executives with unified KPIs and trend visualizations

     • Adds Analytics > Overview page providing a unified KPI strip for Protect, Detect, Remediate, and Govern metrics including repository coverage, incident volume, remediation speed, and identity safeguards.
     • Enables visualization of monitored perimeter trends showing how repository count evolves week over week.
     • Introduces Top Risky Data Sources view to identify repositories generating the most critical and high-severity incidents.
     • Adds Critical Incident Trajectories chart to track incident volume changes over time.
     • Displays Most Common Secret Types breakdown to understand frequently appearing secret categories in the perimeter.

     +2 more show less

     • Provides Closure Progress metrics monitoring auto-closures and manual resolutions for remediation performance.
     • Surfaces Governance Signals view showing vaulted secrets and breached policies for NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. governance insights.

     7 details in Everything

119. Risk score - ML-powered incident prioritization Dec 17, 2025 · release notes

     GitGuardian adds ML-powered risk score (0-100) to incidents for Business workspaces with filtering, sorting, and updated Critical view.

     • Adds a 0–100 risk score to incidents based on secret type, validity, detection context, and exposure patterns.
     • Enables filtering by risk score range and sorting by priority in the incidents table
     • Updates the Critical saved view to show incidents with risk score above 80
     • Introduces a Recommended for business filter in detector settings to help re-enable detectors previously flagged as non-business

     4 details in Everything

120. Secret Enricher - From Generic to Actionable Dec 17, 2025 · release notes

     Secret Enricher v2 provides enriched secret types in UI and API responses for Business/Enterprise plans.

     • Incident UI now displays ML-enriched secret identities (e.g., Redis Identifiers, AWS Access Key) instead of generic detector names like Generic High Entropy Secret.
     • Incident API responses include enriched secret names for programmatic access.
     • CSV and JSON export reports now include both the original detector name and enriched secret name.

     3 details in Everything

121. New NHI Integrations - Airbyte, Anthropic, N8n, OpenAI, CyberArk Self Hosted, an Dec 12, 2025 · release notes

     GitGuardian SaaS adds NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. discovery for Airbyte, Anthropic, and more; incidents API date filtering

     └──▷ HOW TO FIND IT
     Connect a new Airbyte workspace to expand NHI discovery coverage.
     📍Navigate to Settings › Integrations › Sources › NHI Governance and connect your Airbyte, Anthropic, N8n, OpenAI, CyberArk Secrets Manager Self Hosted, or Slack workspace.
     • Adds Identity Discovery for Airbyte, Anthropic, N8n, OpenAI, CyberArk Secrets Manager Self Hosted, and Slack via Settings > Integrations > Sources > NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems.
     • Adds support for filtering incidents by triggered date in the public Incidents API endpoint
     • Adds Valid saved view to the Incidents Dashboard available for all accounts

     3 details in Everything

122. SCIM Team provisioning now available Nov 17, 2025 · release notes

     GitGuardian SaaS adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. team provisioning for Okta and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.

     • Adds SCIM team provisioning capability for Okta and Microsoft Entra IdPs
     • Requires teams:write and members:write service account token scopes

     2 details in Everything

123. Playbooks extended to Public Monitoring Nov 7, 2025 · release notes

     GitGuardian Playbooks now support Public Monitoring to automate secret remediation workflows.

     • Adds Playbooks support for public secret incidents in Public Monitoring
     • Exposes the change_type field for secret occurrences via the API

     2 details in Everything

124. Graph Enhancement and HasMySecretLeaked Integration Oct 28, 2025 · release notes

     Enhanced identity graph unifies public leak detection and displays large occurrence patches in incident views

     • Displays severity levels, source information, and occurrence data directly within the unified identity graph interface for both internal and public monitoring incidents
     • Adds three distinct types of public exposure categorization to the HasMySecretLeaked integration: secrets in monitored public sources, incidents in your public perimeter, and external GitHub locations
     • Unifies previously scattered exposure indicators under a new Publicly Leaked tag across Internal Monitoring, Public Monitoring, and NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. modules

     3 details in Everything

125. Enhanced Slack Notifications - Public Monitoring, Internal Monitoring & Honeytok Oct 25, 2025 · release notes

     Enhanced Slack notifications now cover incident lifecycle events, public monitoring, and honeytoken alerts with granular per-channel configuration.

     • Slack notifications now include incident resolution, assignment, status changes, comments, access control, and sharing events in addition to new detections and regressions
     • Public monitoring incidents can be sent to Slack channels alongside internal monitoring alerts for perimeter security visibility
     • Honeytoken alerting is now supported in Slack notifications, previously limited to custom webhooks and email
     • Slack webhook configuration supports subscribing to specific event types per channel for granular notification control
     • Custom Monitored Perimeter can now be edited via the Public API for all sources except custom sources

     5 details in Everything

126. ggshield - Show vault information for vaulted secrets Oct 17, 2025 · release notes

     ggshield now exposes vault names and paths for secrets in integrated managers

127. GitGuardian Bridge - Secure Access to All Your Self-Hosted Services Oct 9, 2025 · release notes

     GitGuardian Bridge expands to all self-hosted services; adds Generic Secret Enricher v2 and False Positive Remover v2.5

     • GitGuardian Bridge now supports comprehensive integration with any self-hosted service in private networks, including GitHub Enterprise, GitLab, Jira Data Center, Confluence, Container registry, and custom sources, using flexible domain mapping.
     • Generic Secret Enricher v2 introduces 50 new providers and enhances enrichment by 75% for public data and 50% for internal data.
     • False Positive Remover v2.5 improves detection of false positives in secret identifiers, file paths, variable names, and plugin versions; the vendor reports twice as many identified, varying by customer.
     • Added automatic Jira ticket assignment to incident authors via email matching for both Jira Cloud and Data Center.

     4 details in Everything

128. MS Teams attachment scanning is here! Sep 30, 2025 · release notes

     GitGuardian SaaS now scans Microsoft Teams file attachments for secrets with no extra setup or cost.

     • Adds automatic scanning of file attachments shared within Microsoft Teams to detect hidden secrets
     • Enables manual historical scanning of past Teams messages via the perimeter interface to cover previously unscanned attachment debt

     2 details in Everything

129. “Explore” and find more company-related secrets! Sep 26, 2025 · release notes

     New Explore feature in Public Monitoring enables proactive discovery of organizational secrets in public repos.

     • Adds Explore UI section under Public Monitoring for company-focused secret discovery
     • Enables targeted queries against domains, service names, and internal system references in public GitHub repositories
     • Supports CSV export of the developer list from the Public Monitoring perimeter view

     3 details in Everything

130. Seal the Leak - Instantly Revoke Secrets with GitGuardian! Sep 23, 2025 · release notes

     GitGuardian SaaS adds in-platform Secret Revocation for GitHub, GitLab, and OpenAI via a new Revocable by GitGuardian tag.

     • Adds the Revocable by GitGuardian tag to incidents containing secrets that can be immediately revoked from the platform, accelerating incident response workflows
     • Enables in-platform secret revocation for supported providers (GitHub, GitLab, OpenAI) via a call-to-action in the incident detail view, which automatically resolves valid revocations and logs them in the incident timeline
     • Adds Container Registries endpoints to the public API documentation.

     3 details in Everything

131. Introducing AI Filters - It's time to have a conversation with your data! Sep 17, 2025 · release notes

     GitGuardian SaaS introduces AI Filters for natural language querying and GitHub Check Runs with public share links

     • Adds AI Filters in Incidents, Perimeter, and Audit Logs to query data using natural language queries
     • Adds the ability to save AI-generated filters as views for team sharing
     • Adds option in GitHub Check Runs to include public share links for incident details

     3 details in Everything

132. Context Preview for non-VCS Secret Leaks! Aug 20, 2025 · release notes

     Context Previews now available by default for non-VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. Secret Leaks incidents to accelerate investigation.

     • Adds automatic Context Preview visibility for Secret Leaks in non-VCS sources (SharePoint, OneDrive, Slack, Confluence) directly within GitGuardian incidents.

     1 detail in Everything

133. Public Monitoring API endpoints now available Aug 1, 2025 · release notes

     GitGuardian adds Public Monitoring API endpoints to manage public incidents and list public-perimeter developer information.

134. Extend your security coverage with Public Monitoring Jul 25, 2025 · release notes

     New unified module extends secrets scanning to public GitHub with correlated incident management.

135. New Analytics - Gain Deeper Insights into Your Security Posture Jul 23, 2025 · release notes

     New Internal Monitoring analytics dashboards and multi-hook GitLab integration support

     • Adds new Internal Monitoring analytics dashboards tracking Protect, Detect, Remediate, and Prevent dimensions via Count of sources, Most detected secrets, Top teams by incident count, Top sources by incident count, Median time to remediate, Total count of incidents avoided by GGShield, and GGShield scans over time charts and tables
     • Supports simultaneous configuration of multiple GitLab integrations using both system hooks and group hooks

     2 details in Everything

136. Historical Scanning now available for Confluence Data Center Jun 30, 2025 · release notes

     GitGuardian SaaS adds historical secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. for Confluence Data Center

     • Enables historical secret scanning for Confluence Data Center, surfacing secrets leaked in past content rather than only real-time detections.
     • Enhances Jira Data Center integration to include leaker email addresses in incident creation for historical comment occurrences.

     2 details in Everything

137. GitGuardian MCP Server - Security in Your AI IDE Jun 19, 2025 · release notes

     GitGuardian MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. releases for AI IDEs; Custom Tags API adds key/value filtering.

     • Releases the GitGuardian MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server on GitHub to bring security scanning and incident management into Cursor, Windsurf, and other Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-compatible IDEs
     • Enhances the custom tags filter in the public API to support filtering by key/value pairs in addition to IDs

     2 details in Everything

138. Securely Access Secret Values via API with GitGuardian's New “Secrets” Endpoint May 23, 2025 · release notes

     GitGuardian adds /v1/secrets/{secret_id} to retrieve secret values and detector information through the API.

     • Adds the /v1/secrets/{secret_id} API endpoint that returns the secret value alongside detector information in a single response

     1 detail in Everything

139. Automate User Onboarding & Offboarding with SCIM May 21, 2025 · release notes

     GitGuardian SaaS adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.-based automated user provisioning and deprovisioning for Okta and Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments..

     • Adds automatic user provisioning and deprovisioning via SCIM integration
     • Requires Workspace Settings > Authentication to enable SCIM

     2 details in Everything

140. Secrets Detection in Microsoft Teams May 5, 2025 · release notes

     New Secrets Detection in Microsoft Teams adds real-time and historical scanning capabilities for Teams messages.

     • Adds hardcoded secret detection for Microsoft Teams, scanning both new activity and historical content.
     • Updates weekly digest and historical scan emails to include the number of incidents in the subject line.

     2 details in Everything

141. Customize Your Incidents View for Enhanced Context Exploration May 2, 2025 · release notes

     GitGuardian adds fully customizable views for the Incidents page to filter, sort, and prioritize security data.

     • Adds ability to create fully customized Incident views displaying specific properties and exploring security data.

     1 detail in Everything

142. Historical Scanning now available for Jira and Confluence Cloud sources. Apr 29, 2025 · release notes

     GitGuardian adds a Public API GET endpoint for retrieving invitation details.

143. Secure your Non-Human Identities with NHI Governance Apr 23, 2025 · release notes

     Introduces NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. for non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. management and adds GET /v1/invitations/{invitation_id} API endpoint

     • Adds NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. Governance solution for comprehensive observability and lifecycle management of Non-Human Identities across environments like CI/CD pipelines and Kubernetes Clusters.

     1 detail in Everything

144. Prioritize faster with Secrets Analyzer Apr 14, 2025 · release notes

     Secrets Analyzer adds scope/permission context; Custom Tags and webhook payload enhancements in SaaS

     • Adds Secrets Analyzer which automatically gathers scopes, permissions, ownership, and perimeter information for detected secrets to aid prioritization
     • Enables creating Custom Tags directly from search queries in the dashboard
     • Adds team name and webhook name fields to the custom webhook payload for incidents and occurrences

     3 details in Everything

145. Improve incident remediation with custom tags Mar 24, 2025 · release notes

     Custom tags for incident categorization and filtering, plus email notification options

     • Adds support for custom tags to categorize, filter, and search incidents in the GitGuardian platform
     • Adds All incidents (default) or Only incidents involving yourself options for email notifications

     2 details in Everything

146. Detect hardcoded secrets in your Container Registries Mar 19, 2025 · release notes

     GitGuardian SaaS adds hardcoded secret detection for Azure ACR, Amazon ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., Google Artifact Registry, JFrog, and DockerHub container images.

147. Leverage insights from your Secrets Managers Feb 28, 2025 · release notes

     GitGuardian SaaS adds ggscout integration with AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, Google Secret Manager, Delinea, and Akeyless to sync secret incidents.

148. ServiceNow secret scanning Jan 28, 2025 · release notes

     GitGuardian SaaS adds ServiceNow secret and honeytoken detection for automated incident tracking

     • Adds ServiceNow as a supported integration for automated tracking of security incidents via secret and honeytoken detection.
     • Enhances Jira Data Center integration to support User Picker (single user) custom fields in templates.

     2 details in Everything

149. Bitbucket Cloud scanning, Microsoft Teams alerts & Jira issue tracking Jan 13, 2025 · release notes

     GitGuardian adds Bitbucket Cloud scanning, Microsoft Teams alerts, and Jira Data Center auto-tracking in Jan 2025 release.

     • Enables secrets detection and real-time monitoring for Bitbucket Cloud repositories
     • Delivers real-time GitGuardian security incident notifications directly to Microsoft Teams channels with direct investigation links
     • Integrates Jira Data Center to auto-create issues on new incidents, sync custom fields, and auto-resolve incidents when linked Jira issues close

     3 details in Everything

150. ML-Powered Similar Incident Grouping - Combat Incident Fatigue! Jan 8, 2025 · release notes

     Adds ML-powered similar incident grouping to sidebar for bulk remediation on Business & Enterprise plans

     • Introduces ML-Powered Similar Incident Grouping that automatically groups related security incidents (e.g., rotating tokens, QA credentials) based on context beyond just detector types.
     • Adds a Similar Incidents section to the sidebar of any incident detail page to view grouped items and execute bulk actions for efficient remediation.
     • Improved token refresh reliability for Slack and Atlassian Cloud integrations with automatic retry on transient failures.

     3 details in Everything

151. December 23, 2024 Dec 23, 2024 · release notes

     GitGuardian adds GitLab OAuth Application Token detector in Dec 23, 2024 release

     • Added GitLab OAuth Application Token to the secrets detection engine (v2.129)

     1 detail in Everything

152. December 12, 2024 Dec 12, 2024 · release notes

     GitGuardian SaaS updates detection engine v2.128 with four new detectors and allows disabling auto repo monitoring via GitHub integration

     • Adds Jenkins API token, chpasswd Username Password, Nessus Agent Key, and Statsig Server Secret Key detectors in secrets detection engine v2.128
     • Allows Workspace Managers to disable automatic repository monitoring during VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. integration setup

     2 details in Everything

153. December 5, 2024 Dec 5, 2024 · release notes

     GitGuardian SaaS adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user provisioning, secret pattern exclusions, GitHub forked repo checks, and Jira template selection.

     • Adds steps for SCIM integration enabling automatic user deprovisioning in GitGuardian based on Identity Provider changes
     • Adds steps to define secret pattern exclusion rules to hide secrets matching defined patterns from all or specific repositories
     • Adds steps to enable GitGuardian check runs on GitHub forked repositories for Business workspaces
     • Adds steps for a template selection dropdown when manually creating Jira Cloud issues via the integration

     4 details in Everything

154. November 18, 2024 Nov 18, 2024 · release notes

     GitGuardian SaaS adds send_email param to invite API, instance-level GitLab integration via admin token, and v2.126 secrets detection with 4 new detectors.

     • Adds send_email: true|false parameter to Platform API endpoints that trigger email notifications (e.g., invitation creation) to control whether an email is sent
     • Upgrades secrets detection engine to version 2.126, adding support for X-API Key Secret, Azure Functions App Key Header, and Azure Functions App Key Query Parameter detections

     2 details in Everything

155. November 4, 2024 Nov 4, 2024 · release notes

     SaaS release adds secrets detection engines v2.125, scopes for All Sources API, and new Settings sections.

     • Secrets detection engine upgraded to version 2.125
     • Added sources:read scope for GET endpoints in the All Sources API
     • Added sources:write scope for PATCH endpoint in the All Sources API
     • New Integrations section under Settings

     4 details in Everything

156. October 28, 2024 Oct 28, 2024 · release notes

     Adds ServiceNow Issue Tracking integration for automated incident management

     • Adds ServiceNow issue tracking integration to create issues from GitGuardian incidents
     • Enables auto-resolve setting to mark GitGuardian incidents as resolved when the linked ServiceNow issue closes

     2 details in Everything

157. October 21, 2024 Oct 21, 2024 · release notes

     GitGuardian adds GitHub custom properties override for check runs and bulk historical scan management with instance filtering.

     • Adds gh_custom_properties support to leverage GitHub's custom properties for overriding GitGuardian global configuration of check runs at repository and organization levels
     • Introduces Bulk Historical Scans Management page with a new filter for instances (e.g., production/staging) to track and filter historical scans

     2 details in Everything

158. October 17, 2024 Oct 17, 2024 · release notes

     GitGuardian SaaS allows secrets detection filepath exclusions to be scoped to specific repositories.

     • Adds repository-scoped filepath exclusions for secrets detection incidents.

     1 detail in Everything

159. October 7, 2024 Oct 7, 2024 · release notes

     GitGuardian adds ggshield VS Code extension and secrets engine v2.122

     • Adds GitGuardian CLI (ggshield) as a VS Code extension with automatic file scanning on save and in-IDE remediation guidance
     • Upgrades secrets detection engine to version 2.122, adding Atlassian Access Token, Bitbucket Access Token, and Mistral AI API Key detectors

     2 details in Everything

160. September 23, 2024 Sep 23, 2024 · release notes

     Jira Data Center integration for secret/honeytoken detection and Honeytoken saved views added in GitGuardian SaaS.

     • Adds Jira Data Center integration to support real-time secret detection and honeytoken detection
     • Adds the ability to create Saved views in Honeytoken

     2 details in Everything

161. September 9, 2024 Sep 9, 2024 · release notes

     GitGuardian adds Confluence Data Center integration, Slack history scanning, IP allowlisting, and Historical Scan filters.

     • Confluence Data Center integration enables real-time secret detection and honeytoken detection for Confluence Data Center instances
     • Platform IP allowlist allows managers to restrict access to the dashboard and API by specified IP addresses or ranges (Business accounts only)
     • Historical Scan UI adds new filters for failure reasons and last scan date

     3 details in Everything

162. August 26, 2024 Aug 26, 2024 · release notes

     GitGuardian SaaS upgrades secrets detection engine to v2.120 with two new detectors and fixes Jira Cloud pagination.

     • Adds Generic Password YAML detector for identifying passwords in YAML files
     • Adds Buildkite API Token V2 detector for identifying Buildkite tokens
     • Enhances recall for existing detectors including Generic Database, Base64, and High Entropy Secret

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !reCAPTCHA Key detector now skips validity checks for reCaptcha keys, potentially increasing noise as validity can no longer be ensured due to Google API changes
163. August 14, 2024 Aug 14, 2024 · release notes

     GitGuardian August 14 2024 adds saved views, custom remediation messages, and a new team leader API field

     • Adds is_team_leader boolean in the /v1/teams/{team_id}/team_memberships and /v1/teams/{team_id}/team_invitations API endpoints to replace the deprecated team_permissions field for designating team owners.
     • Adds Saved Views feature allowing admins to save frequently used filters as named views for quicker access in the dashboard.
     • Adds custom remediation message support in ggshield for pre-commit, pre-push, or pre-receive stages to provide developers with internal guidance.
     • Adds Health Check capability in the GitGuardian dashboard letting managers manually start checks for failed items immediately.

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The team_permissions field is deprecated and replaced by the is_team_leader field in the /v1/teams/{team_id}/team_memberships and /v1/teams/{team_id}/team_invitations API endpoints.
164. July 29, 2024 Jul 29, 2024 · release notes

     GitGuardian SaaS adds ML-based false positive reduction and GitLab CE integration with optional historical scan skipping.

     • Deploying an in-house machine learning model that halves secrets detection false positives for all Business and Enterprise accounts
     • Adding GitLab Community Edition integration support with the ability to skip historical scans upon installation

     2 details in Everything

165. July 15, 2024 Jul 15, 2024 · release notes

     GitGuardian SaaS adds Microsoft Teams integration, .NET SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. support, scan skip for unchanged repos, and API fields.

     • Adds Microsoft Teams integration for real-time secret and honeytoken detection notifications
     • Enables .NET SCA scanning for C#, F#, and Visual Basic dependencies
     • Introduces a new scan skip mechanism for repositories that have not changed since the last scan
     • Adds pending_timeout status to the API to distinguish queued scans from timed-out ones
     • Exposes secret incident user feedback via the feedback_list field in the API payload

     +2 more show less

     • Displays the workspace data storage region in the workspace settings UI
     • Adds an optional Skip action for check runs on forked repositories with detected secrets

     7 details in Everything

166. June 24, 2024 Jun 24, 2024 · release notes

     Adds per page selector to secrets detection occurrences table; API deprecates role in favor of access_level.

     • Adds a per page selector to the secrets detection incident details occurrences table to control pagination density.

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The role field is deprecated and replaced by the access_level field in the API for endpoints /v1/members and /v1/invitations.
167. June 17, 2024 Jun 17, 2024 · release notes

     GitGuardian SaaS adds detection for Sentry and Slack secret types in engine v2.115

     • Secrets Detection engine upgraded to version 2.115 with expanded secret coverage
     • Adds detection for Sentry Org Auth Token secrets
     • Adds detection for Sentry User Auth Token v2 secrets
     • Adds detection for Slack Configuration Refresh Token secrets
     • Adds detection for Slack Configuration Token secrets

     5 details in Everything

168. June 4, 2024 Jun 4, 2024 · release notes

     GitGuardian adds 9 new secret detectors, GitLab webhook auto-reactivation, Malicious Package detection, and health check email alerts.

     • Adds 9 new secret detectors: ASP.NET Decryption Key, ASP.NET Validation Key, Langchain API Key, OpenAI Project API Key, OpenAI Service Account, Sourcegraph Enterprise Subscription Token, Sourcegraph License Key Token, Sourcegraph User Gateway Access Token, and WakaTime API Key.
     • Updates detection for 4 existing detectors: Sentry Token, Generic Database assignment, Generic FTP Assignment, and Generic Username Password.
     • Enables periodic secret validity checks for ignored incidents to ensure they remain valid over time.
     • Shows the count of new secret incidents that will be hidden by a new filepath exclusion rule during rule creation.
     • Automatically reactivates disabled GitLab webhooks by sending a test payload before triggering an error message.

     +1 more show less

     • Sends email notifications when an integration health check fails, configurable via email preferences settings.

     6 details in Everything

169. May 27, 2024 May 27, 2024 · release notes

     New API endpoint for querying secret incidents and improved incident details with GitHub merge commit author attribution.

     • Adds a new API endpoint to query the secret incidents of a specific source
     • Merges commit authors from GitHub into Secrets Detection Incidents details

     2 details in Everything

170. May 20, 2024 May 20, 2024 · release notes

     GitGuardian adds Nylas, Sourcegraph v3, Vercel and other new secret detectors plus platform health check tracking

     • Adds detection for Nylas API Key secrets
     • Adds detection for Sourcegraph Access Token v3 secrets
     • Adds detection for Duplo Cloud API Key secrets
     • Adds detection for Fernet Key secrets
     • Adds detection for Vercel Blob Token secrets

     +1 more show less

     • Introduces Platform Health Check tracking for last execution and last successful execution times with hourly periodic checks

     6 details in Everything

171. May 6, 2024 May 6, 2024 · release notes

     Platform API tokens now include workspace_id; improved historical scan status visibility.

     • Adds workspace_id to the payload of API tokens in the Platform API
     • Improves historical scan status overview on the perimeter page sidebar

     2 details in Everything

172. April 23, 2024 Apr 23, 2024 · release notes

     GitGuardian SaaS adds Grafana Cloud API Key, Groq API Key, and Nx Cloud Token detectors in v2.111; allows deletion of AI query history.

     • Secrets detection engine upgraded to version 2.111 with three new detector types: Grafana Cloud API Key, Groq API Key, and Nx Cloud Token

     1 detail in Everything

173. April 16, 2024 Apr 16, 2024 · release notes

     GitGuardian SaaS extends its secret management capabilities by integrating with CyberArk's Platform Vault.

174. April 15, 2024 Apr 15, 2024 · release notes

     April 15 release adds Generic CLI/DB detectors, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. mod date filter, and updates detection engine v2.110

     • Generic CLI Secret and Generic Database Assignment detectors are now supported and active by default for data sources other than VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures..
     • SCA incidents now include the last modification date of dependency files, along with a dedicated filter to view them.
     • Secrets detection engine upgraded to version 2.110, adding support for Dropbox Key, Midtrans API Key, Sanity Token, and Zuplo API Key detectors.

     3 details in Everything

175. April 10, 2024 Apr 10, 2024 · release notes

     GitGuardian SaaS introduces a new Jira Cloud integration with auto-create, custom fields, and auto-resolve for incident tracking

     • Adds automatic creation of a Jira issue upon new incident trigger via the Jira Cloud integration

     1 detail in Everything

176. April 8, 2024 Apr 8, 2024 · release notes

     GitGuardian SaaS adds dynamic-only honeytonedeployment and a secret identity card to incident pages.

     • Honeytoken Context creation strategies now support selecting only dynamic contexts for deployment jobs
     • Secret Incident detail pages now display a secret identity card
     • Privacy mode can obfuscate secrets and other sensitive information in the GitGuardian UI

     3 details in Everything

177. March 25, 2024 Mar 25, 2024 · release notes

     GitGuardian SaaS adds PHP dependency support and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores to SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. incidents

     • Adds Support for PHP dependencies in the Software Composition Analysis (SCA) scanner
     • Includes the EPSS score in SCA incident details along with a dedicated filter

     2 details in Everything

178. March 18, 2024 Mar 18, 2024 · release notes

     GitGuardian SaaS adds filtering on Occurrences count and severity breakdown to API payload

     └──▷ HOW TO FIND IT
     Filter incidents by frequency to focus on high-volume issues.
     📍In the Incidents view, use the filter dropdown to select Occurrences count and enter your threshold.
     • Adds Occurrences count filter to Incidents view
     • Includes secret incident severity breakdown in the API response payload

     2 details in Everything

179. March 11, 2024 Mar 11, 2024 · release notes

     GitGuardian SaaS adds PHP dependency support to its SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. engine

     • Adds PHP dependencies to the Software Composition Analysis (SCA) engine for scanning third-party library vulnerabilities.

     1 detail in Everything

180. March 4, 2024 Mar 4, 2024 · release notes

     GitGuardian SaaS adds Honeytoken deployment permissions UI and exposes Incident tags in CSV export.

     • Adds GitHub/GitHub Enterprise Server integration settings with actions to configure write permissions for Honeytoken deployment jobs
     • Exposes incident tags in the All occurrences CSV report

     2 details in Everything

181. February 26, 2024 Feb 26, 2024 · release notes

     Jira Cloud integration for secrets detection adds First detected date to incidents

     • Adds Jira Cloud integration support for real-time secret and honeytoken detection.
     • Adds the First detected date field to incident details and the associated filter in the Secret incident dashboard.

     2 details in Everything

182. February 19, 2024 Feb 19, 2024 · release notes

     GitGuardian SaaS enhances secrets detection capabilities with updated detectors and introduces automated honeytoken deployment jobs.

     • Secrets detection engine upgrade to version 2.106
     • Improvements to Generic Password, Generic High Entropy Secret, and Base64 Generic High Entropy Secret detectors
     • Automated honeytoken deployment jobs for GitLab, GitHub, and GitHub Enterprise Server

     3 details in Everything

183. February 13, 2024 Feb 13, 2024 · release notes

     Adds IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. shifting left metrics to analytics and improves Platform Check runs timeout transparency.

184. January 29, 2024 Jan 29, 2024 · release notes

     GitGuardian SaaS adds Square Token detector and configurable CSV export separators.

     • Adds Square Token detection engine (v2.105)
     • Exporting CSV secret incidents now supports configurable separator (comma or tab)

     2 details in Everything

185. January 22, 2024 Jan 22, 2024 · release notes

     GitGuardian SaaS adds Bunny.net and Hugging Face detectors; updates secrets engine to v2.104

     └──▷ HOW TO FIND IT
     Ensure Azure repository monitoring works correctly by updating the Personal Access Token scope.
     📍In your Azure DevOps organization settings, update the Personal Access Token used by GitGuardian to include the Graph:Read scope.
     • secrets detection engine upgrades to version 2.104, introducing new detection for Bunny.net API Key and Hugging Face user access token
     • Platform SSOPlatform SSOA macOS framework from Apple that lets identity providers hook into the operating system login flow, enabling enterprise single sign-on at the platform level rather than per-app. with Force SSO now enforces single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for workspace owners as well as members
     • Azure repos integration requires the Graph:Read scope in Personal Access Tokens for proper billing metrics functionality

     3 details in Everything

186. January 15, 2024 Jan 15, 2024 · release notes

     GitGuardian SaaS upgrades secrets detection engine to v2.103 adding four new detectors.

     • Upgrades secrets detection engine to version 2.103
     • Adds detection for CircleCI Project Token
     • Adds detection for Claude API Key
     • Adds detection for Grafana Service Account Token With Host
     • Adds detection for Klaviyo API Key

     5 details in Everything

187. January 9, 2024 Jan 9, 2024 · release notes

     GitGuardian adds hsml_hash to API payloads, CSV columns for secret incidents, and Ignores IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. tag.

     • Adds hsml_hash field to the secret incident payload for Has My Secret Leaked integration
     • Adds element_url and author_name columns to the secret occurrence CSV report
     • Adds Ignored tag in IaC Security for ggshield-ignored incidents

     3 details in Everything

188. December 11, 2023 Dec 11, 2023 · release notes

     GitGuardian adds Azure Repos integration for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. misconfiguration monitoring and upgrades secrets detection engine.

     • Adds Azure Repos integration to the IaC Security feature for monitoring infrastructure-as-code misconfigurations
     • Upgrades secrets detection engine to version 2.102, introducing 8 new detectors: Base64 AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Keys, Base64 AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure. Keys, Readme API Key, Tailscale API key, Tailscale oauth key, Tailscale pre-auth key, Tailscale SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. key, and Tailscale webhook key

     2 details in Everything

189. November 27, 2023 Nov 27, 2023 · release notes

     GitGuardian adds Azure Repos real-time monitoring, source-level criticality parameters, and Jira issue creation without assignees

     • Introduces a new parameter at the source level to prioritize Secret, SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. incidents via source_criticality.
     • Allows granting Members access to specific SCA and IaC incidents.
     • Enables IP allow-listing for Honeytoken events to prevent triggering from specified IP ranges.
     • Updates the Secrets detection engine (v2.101) adding the Airtable API Key v2 detector.

     4 details in Everything

190. November 15, 2023 Nov 15, 2023 · release notes

     GitGuardian SaaS November 15 release adds Sourcegraph and Cohere detectors and CSV filter preservation.

     └──▷ HOW TO FIND IT
     Export incident reports filtered by a specific project or time range without manually re-filtering after download.
     📍In the Incidents view, apply your desired filters and click Export to CSV.
     Detect Sourcegraph tokens in your codebase during CI checks now that detection is supported.
     📍Run your standard GitGuardian scan; the engine automatically applies new Sourcegraph Token and Cohere API Key detectors.
     • Upgrade secrets detection engine to version 2.100, adding support for Sourcegraph Token and Cohere API Key secret types.
     • CSV export for incidents now preserves applied filters instead of exporting all results.
     • GitHub integration checkruns updated to support the GitHub Merge Queue feature.

     3 details in Everything

191. October 30, 2023 Oct 30, 2023 · release notes

     GitGuardian adds Source Criticality filtering for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. and team-based filtering for incidents and perimeters

     • Adds a new Source Criticality field and filter to the IaC security incident view (IaC beta)

     1 detail in Everything

192. October 16, 2023 Oct 16, 2023 · release notes

     New API for team secret incidents, restricted git patch visibility, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. remediation analytics in GitGuardian SaaS.

     • GET /api/team/{team_id}/incidents endpoint to retrieve secret incidents for a specific team
     • New remediation analytics for IaC security (beta feature for testers)

     2 details in Everything

193. October 3, 2023 Oct 3, 2023 · release notes

     GitGuardian SaaS v2.98 adds 4 new secret detectors and historical scan tooltip details.

     • Adds Aiven, Infracost API Key, Rollbar API Access Token, and Vercel to the secrets detection engine (v2.98)
     • Displays scan duration, commit/branch counts, and failure reasons in historical scan status tooltips

     2 details in Everything

194. September 28, 2023 Sep 28, 2023 · release notes

     Adds Publicly leaked tag to secret incidents exposed on public GitHub.

195. September 21, 2023 Sep 21, 2023 · release notes

     GitGuardian SaaS September 2023 release adds team-level alerting and incident occurrence limits

     • Imposes a limit of 1000 occurrences per incident in the Secrets detection engine to manage incident volume.
     • Adds navigation links to the Get Started page within email notifications upon completion of the first scan.

     2 details in Everything

196. August 22, 2023 Aug 22, 2023 · release notes

     GitGuardian SaaS introduces IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. Security monitoring, remediation, and new ggshield subcommands.

     • Adds ggshield pre-commit, pre-push, pre-receive, and ci subcommands for IaC security scanning
     • Enables IaC monitoring and remediation features on the GitGuardian platform
     • Upgrades secrets detection engine to version 2.96, adding Generic Terraform Variable Secret and CARTO API Access Token detectors

     3 details in Everything

197. August 7, 2023 Aug 7, 2023 · release notes

     Workspace-level public sharing for incidents and new secret detectors via Databricks/Vault support

     • Secrets detection engine v2.95 adds Databricks Authentication Token With Hostname detector for secret identification.
     • Secrets detection engine v2.95 adds Hashicorp Vault Token detector for secret identification.

     2 details in Everything

198. July 24, 2023 Jul 24, 2023 · release notes

     GitGuardian SaaS adds four new secret detectors (Azure AD, Docusign, Pinecone) and renames the share modal.

     • Adds support for detecting Azure Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. API Keys, Docusign API Key, and two variants of Pinecone API Key in the secrets detection engine.
     • Moves the public sharing toggle to a renamed Share modal (previously Grant access) for incident details.
     • Adds an explanation tooltip to the Default branch tag in the Incidents view.

     3 details in Everything

199. July 10, 2023 Jul 10, 2023 · release notes

     GitGuardian adds IP tagging rules for honeytokens and honeytoken label management API endpoints

     • Adds custom IP tagging rules for honeytoken events to assign tags based on source IP address
     • Adds new API endpoints to manage labels for honeytokens
     • Shows country flag next to the IP address in the honeytoken events table

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Custom webhook v1 has been replaced by event-based custom webhooks
200. June 26, 2023 Jun 26, 2023 · release notes

     GitGuardian adds Default branch tag to secrets incidents, enforces PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. lifetime via API, and upgrades secret detection engine.

     • Adds the Default branch tag to secret incidents that occurred on the default git branch of a repository
     • API endpoint enables managers of workspaces under the Business plan to enforce a maximum lifetime for personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. generated on their workspace
     • Upgrades secrets detection engine to version 2.92 with two new detectors ( AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure. Keys , Forest Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. Key ) and improved coverage for six existing detectors

     3 details in Everything

201. June 12, 2023 Jun 12, 2023 · release notes

     GitGuardian adds incident feedback forms, honeytoken management and new secret detectors

     • Incidents page now includes a standardized form for submitting remediation feedback.
     • Adds publicly shared filter to the Incidents list.
     • Business-only: Team owners with Member role can invite new users to the workspace when adding teammates.
     • Business-only: Users with Full access incident permissions can invite new users to the workspace when granting access to an incident.
     • Honeytoken settings page now supports managing labels directly.

     +2 more show less

     • Honeyton events can now be filtered by tags (AWS internal, GitGuardian Public Monitoring IP).
     • Secrets detection engine upgraded to v2.91 with Tableau Personal Access Token and Yelp API key detectors.

     7 details in Everything

202. May 30, 2023 May 30, 2023 · release notes

     May 30, 2023 release adds custom severity recomputation, new secret detectors, honeytoken search/notifications, and labels on honeytoken endpoints.

     • Custom severity rules option to recompute severity scoring manually
     • ggshield now supports Palantir JWT and Figma Personal Access Token detection via Secrets detection engine v2.90 upgrade
     • ggshield improves LDAP credentials detection via Secrets detection engine v2.90 upgrade
     • Honeytoken list adds Created at column with sorting support
     • Honeytokens can now be searched by ID

     +2 more show less

     • Email notification sent when a honeytoken is publicly exposed
     • labels field added to honeytoken API endpoints

     7 details in Everything

203. May 15, 2023 May 15, 2023 · release notes

     Customizable automated severity rules enabled by default on Free plan

     • automated severity scoring is now customizable via custom severity ruleset to maximize incident coverage.
     • Automated severity scoring is activated by default for all workspaces under the Free plan.

     2 details in Everything

204. May 2, 2023 May 2, 2023 · release notes

     GitGuardian SaaS adds five new secret detectors and exposes them via API in May 2023 release

     • Upgrades secrets detection engine to version 2.89 with five new detector types
     • Exposes secret detection results in the API
     • Activates automated severity scoring by default for new workspaces

     3 details in Everything

205. April 17, 2023 Apr 17, 2023 · release notes

     Filepath search in secret incidents and Cloudinary/MongoDB detectors added

     • Adds filepath search to the free-text search field of the secret incidents table
     • Upgrades secrets detection engine to v2.88 with new detectors for Cloudinary API keys and MongoDB Atlas Keys

     2 details in Everything

206. April 3, 2023 Apr 3, 2023 · release notes

     GitGuardian SaaS April 3, 2023: Customizable remediation workflows, Keycloak detector, and new API endpoints.

     • remediation workflow is now 100% customizable with the removal of the final static step
     • Keycloak Api Keys added as a new detection rule in secrets detection engine v2.87
     • New API endpoints for personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. and service accounts management are available
     • Secret incident payload now includes resolver_id and ignorer_id fields

     4 details in Everything

207. January 23, 2023 Jan 23, 2023 · release notes

     Adds Jira integration and improved API error messages for missing scopes.

     • Introduces the new Jira alerting integration for sending findings to Jira projects
     • Improves API token validation by specifying missing scopes in the error message when a token lacks required permissions

     2 details in Everything

208. January 9, 2023 Jan 9, 2023 · release notes

     Adds a beta analytics page for monitoring IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanning usage and improves the display of historical scan status.

209. December 13, 2022 Dec 13, 2022 · release notes

     Adds event-based custom webhook integration and team description fields in GitGuardian SaaS

     • Adds a description field for teams, visible in the members table alongside the all-incidents team

     1 detail in Everything

210. November 28, 2022 Nov 28, 2022 · release notes

     GitGuardian SaaS Nov 2022 adds external_id to sources API and increases historical scan size limit to 12GB.

     • Adds external_id field to the API source payload to represent the VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. id of a source
     • Increases the maximum size of the historical scan from 1GB to 12GB for Business workspaces

     2 details in Everything

211. November 3, 2022 Nov 3, 2022 · release notes

     GitGuardian SaaS adds Azure Repos beta integration and enhances analytics and webhooks.

     • Adds Azure Repos integration in beta upon request
     • Updates the action field for custom webhooks with user-friendly messages
     • Displays all ggshield modes in the Analytics section

     3 details in Everything

212. October 17, 2022 Oct 17, 2022 · release notes

     GitGuardian SaaS adds team management with granular incident permissions and Auto-resolution playbooks

     • Introduces team management within a workspace for business workspaces with granular incident permissions: can view, can edit, and full access.
     • Adds the Auto-resolution playbook to automatically close incidents that have once been valid and that become invalid.

     2 details in Everything

213. September 8, 2022 Sep 8, 2022 · release notes

     GitGuardian SaaS adds new Member payload for webhooks and notifications on workspace removal

     • Custom webhook now includes a new Member payload for Grant/Remove access actions to track member lifecycle events
     • Users who are removed from a Workspace now receive a notification

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The resolve_reason field has been removed from all custom webhook payloads, potentially breaking integrations that rely on its presence
214. August 22, 2022 Aug 22, 2022 · release notes

     Members API adds retrieve and delete endpoints to enrich the Members section.

215. August 9, 2022 Aug 9, 2022 · release notes

     GitGuardian SaaS adds API filters for member search and role, plus invitations handling on access endpoints.

     • /members API endpoint now supports filtering by role and searching by name or email
     • Features API handles invitations on grant/revoke access endpoints

     2 details in Everything

216. July 27, 2022 Jul 27, 2022 · release notes

     Adds GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. banner auto-reject with 6-month storage, unaffected counts in bulk actions, and audit log API filters

     └──▷ TRY IT
     Filter audit logs to only show events from a specific user or date range using the new query parameters.
     copy

     $ GET /audit-log?user_id=<USER_ID>&date_from=<DATE>&date_to=<DATE>

     • Closing the GDPR consent banner now automatically rejects consent and stores that decision for 6 months
     • Incidents bulk actions now include the count of unaffected items
     • API: The /audit-log list endpoint accepts new filter parameters

     3 details in Everything

217. July 11, 2022 Jul 11, 2022 · release notes

     Adds audit_logs:read API scope and exposes tags on incidents for programmatic workflows.

     • Adds the audit_logs endpoint to the Features API, requiring the audit_logs:read scope for access
     • Exposes tags in the incidents endpoint of the API, enabling filterable queries via tag
     • Includes tags in CSV reports for secrets incidents for external analysis
     • Makes repository names clickable links to filtered incident lists on the Perimeter page

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The issue_id parameter is deprecated in favor of incident_id on incident note management endpoints
218. June 27, 2022 Jun 27, 2022 · release notes

     GitGuardian SaaS adds event-based custom webhook alerting and author filtering on the occurrences API endpoint

     • Custom webhook alerts are now event-based instead of static triggers
     • The /occurrences API endpoint accepts author_name and author_info filter parameters

     2 details in Everything

219. June 14, 2022 Jun 14, 2022 · release notes

     New API endpoints for invitation management and secret incident severity configuration.

     • Adds members:write scope to API keys for managing member invitations via new endpoints

     1 detail in Everything

220. June 1, 2022 Jun 1, 2022 · release notes

     GitGuardian SaaS adds ggshield auth login, incident/role email notifications, CSV export enhancements, and deprecates old scan commands.

     └──▷ USE IT
     Authenticate the ggshield CLI for a new machine or environment reset.
     shell copy

     ggshield auth login

     • Adds ggshield auth login command to simplify credential configuration for the CLI tool.
     • Sends an email notification to Restricted users when they are granted access to an incident.
     • Sends an email notification to members when their role is updated.
     • Adds status, ignore_reason, and status_revoked columns to the CSV export of secret incidents.
     • Adds occurrence_id column to the CSV export of occurrences.

     +1 more show less

     • Returns dates in ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. format in all CSV exports.

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The ggshield scan command is deprecated; use ggshield secret scan instead.
     • !The ggshield ignore command is deprecated; use ggshield secret ignore instead.
221. May 17, 2022 May 17, 2022 · release notes

     Exposes base/head branch data for GitHub pull requests and marks rewrite git history as optional.

     • Allows users to mark the rewrite git history remediation step as optional

     1 detail in Everything

222. April 4, 2022 Apr 4, 2022 · release notes

     GitGuardian April 4, 2022 release adds repository state to incidents and Personal Access Token monitoring for Managers.

     • Display repository state (unmonitored or deleted) on incidents list and incident detail pages
     • Adapt API to be compatible with personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.
     • Managers can monitor the Personal access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. created on the workspace in the API section

     3 details in Everything

223. March 23, 2022 Mar 23, 2022 · release notes

     GitGuardian adds PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., service account audit logs, incident member API, new API pages, and check run limits.

     • Introduces Personal Access Tokens as a new type of API key for the Features API.
     • Adds an Audit Log for Service Account actions.
     • Adds a new endpoint to list workspace members having access to an incident.
     • Makes Quota, Service Account, and Secrets detection playground pages available in the API section.

     4 details in Everything

224. March 7, 2022 Mar 7, 2022 · release notes

     Adds automatic scanning for Bitbucket repositories upon integration

225. February 21, 2022 Feb 21, 2022 · release notes

     New workspace members API endpoint, enhanced Source payload fields with filtering, and incident-based user invitation.

     • Adds GET /api/v1/workspaces/{id}/members endpoint to list workspace members
     • Extends the Source payload with health, last_scan, open_incidents_count, and closed_incidents_count fields
     • Adds health and last_scan query parameters to filter sources in the API
     • Allows inviting new Restricted users directly from an incident UI

     4 details in Everything

226. February 9, 2022 Feb 9, 2022 · release notes

     GitGuardian adds last scan status filtering, detector incident counts, custom detector questions, and GitHub check run linking.

     • Perimeter UI gains filtering by last scan status
     • Detector table now shows the number of secret incidents for each detector
     • Custom detectors allow adding questions in the Additional notes placeholder
     • Business plan users can extend the secrets detection engine with organization-specific secrets via Custom detectors
     • GitGuardian incidents are now linked to GitHub check runs

     5 details in Everything

227. January 24, 2022 Jan 24, 2022 · release notes

     Adds filtering/sorting to members table, bulk actions for Restricted users on incidents, and detector type display.

     • Adds filtering and sorting controls to the Members and Invitations tables
     • Displays the detector type (generic/specific) in the Detectors table

     2 details in Everything

228. January 17, 2022 Jan 17, 2022 · release notes

     Integrations list sorted alphabetically by default; incident detail sidebar scrolling improved.

     • Sorts Integrations sources alphabetically by default in the UI
     • Improves the right sidebar scrolling behavior in Incident detail

     2 details in Everything

229. November 30, 2021 Nov 30, 2021 · release notes

     Adds Regression setting for incident handling and fixes analytics display.

     • Add the Regression setting in Features Settings to control whether reoccurrences reopen resolved incidents
     • Display deleted sources in the Top 5 sources Analytics panel

     2 details in Everything

230. November 14, 2021 Nov 14, 2021 · release notes

     Secret validity in Features API and new grant/revoke access endpoints

     • Adds secret validity information to the Features API response payload for each detected secret.
     • Introduces new API endpoints /incidents/{id}/grant-access and /incidents/{id}/revoke-access for managing incident permissions.
     • Updates custom webhook payloads to include validity and severity fields for incidents.

     3 details in Everything

231. November 3, 2021 Nov 3, 2021 · release notes

     New audit log search by incident ID, bulk scan cancellation, and GitHub check run comments.

     • Audit log now supports filtering by incident_id and event_name to locate specific security events
     • Adds bulk secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. cancellation endpoint allowing administrators to abort multiple ongoing historical scans simultaneously
     • GitHub integration posts secret detection results as comments directly on the pull request timeline via check runs
     • GitLab group hook integration now supports the token_edition parameter for token management

     4 details in Everything

232. October 13, 2021 Oct 13, 2021 · release notes

     GitGuardian adds Restricted role, auto-access playbook, incident sharing API, audit log for check runs, and GitLab multi-group support.

     • Adds the Restricted role to the RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. model for tighter access control
     • Introduces an Auto-access granting playbook to automate permission assignments
     • Adds a new API endpoint for sharing and unsharing incidents programmatically
     • Adds an audit log for check runs settings to track configuration changes
     • Enables GitLab.com integration with support for multiple GitLab groups

     5 details in Everything

233. September 20, 2021 Sep 20, 2021 · release notes

     GitGuardian SaaS adds secret validity checks for incidents and presence data to CSV reports and API payloads.

     • Introduction of validity checks for secret incidents
     • Manual triggering of validity checks for secret incidents
     • Adds presence information to incidents in the CSV report and the API occurrence payload

     3 details in Everything

234. September 7, 2021 Sep 7, 2021 · release notes

     GitGuardian SaaS adds manual secret presence checks and new API search/filtering capabilities.

     • Adds manual triggering of secret presence checks to verify if a secret still appears in the repository.

     1 detail in Everything

235. August 11, 2021 Aug 11, 2021 · release notes

     GitHub Checkrun customization, multi-GitHub Enterprise support, dedicated historical scan queue, and Bitbucket search filter coverage

     • GitHub Checkruns now allow customization of the message and final status (fail or neutral).
     • Integrations can now connect several GitHub Enterprise Server instances.
     • Business workspaces have a dedicated queue for historical scanning.
     • Incidents search filters now support Bitbucket repositories.

     4 details in Everything

236. July 27, 2021 Jul 27, 2021 · release notes

     GitGuardian SaaS July 27, 2021 adds Docker integration and TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. support for shared incident links.

     • Adds docker integration to the platform.
     • Adds TTL (Time To Live) expiration to share incident links.

     2 details in Everything

237. July 13, 2021 Jul 13, 2021 · release notes

     New API data management scopes, GitHub dangling installation linking, and onboarding todo list.

     • Adds data_management scopes to the API key configuration for finer-grained access control
     • Enables linking a dangling GitHub App installation to a workspace via the UI or direct app install
     • Introduces an onboarding todo list to guide new users through initial setup steps

     3 details in Everything

238. June 30, 2021 Jun 30, 2021 · release notes

     Adds analytics panel for shift-left visualization and ggshield configuration instructions; enforces 20MB API limit.

     • Add Features Analytics panel to visualize shift left efforts.
     • Add instruction page on how to configure ggshield with each CI/CD tool.
     • API now respects the 20MB limit.

     3 details in Everything

239. June 14, 2021 Jun 14, 2021 · release notes

     GitGuardian introduces incident severity and new workspace incidents API endpoints.

     • Adds severity field to incidents for easier triaging
     • Implements GET /workspaces/{workspace_id}/incidents endpoint
     • Implements GET /workspaces/{workspace_id}/sources endpoint

     3 details in Everything

240. May 26, 2021 May 26, 2021 · release notes

     GitGuardian SaaS adds filepath exclusions, workspace email settings, incident assignee filtering, bulk notes, CI/CD for Drone/Azure, and closed perimeter links

     • Adds the ability to configure and test a filepath exclusion list to stop monitoring specific paths
     • Allows users to customize email notifications for each individual workspace via settings
     • Adds assignee visibility and filtering in the incidents table for closed incidents
     • Introduces quick action buttons (resolve/ignore/reopen/assign) directly in the incident table row
     • Adds a bulk action add note for selecting multiple incidents at once

     +3 more show less

     • Updates the how to remediate section with detailed indications and blog links
     • Adds a link to the incidents page for closed incidents within the Perimeter view
     • Extends CI/CD support to include Drone.io and Azure Pipelines

     8 details in Everything

241. May 5, 2021 May 5, 2021 · release notes

     GitGuardian adds Auto-healing playbook for secret incidents with developer share links and feedback filters.

     • Introduces Auto-healing playbook to automatically send incident share links to developers involved in a secret incident
     • Adds developer feedback filter to the incidents table along with icons indicating feedback status
     • Enables resolve/ignore actions directly on the share page for incident shares
     • Updates CSV reports for secret incidents to respect current table filters and search results

     4 details in Everything

242. April 19, 2021 Apr 19, 2021 · release notes

     GitGuardian SaaS adds Pagerduty/Discord/Splunk alerting, GGShield integration page, and cancelable historical scans

     • Add Pagerduty, Discord, and Splunk integrations to the alerting configuration for immediate notification of secrets findings
     • Display ggshield (git hook, CI/CD) integrations on the central integrations page for unified management of developer tooling
     • Add ability to cancel a running historical scan from the UI to reclaim compute resources

     3 details in Everything

243. April 6, 2021 Apr 6, 2021 · release notes

     GitGuardian introduces Analytics section and incident sharing capabilities

     • Adds Analytics section for workspace metrics monitoring

     1 detail in Everything

244. March 9, 2021 Mar 9, 2021 · release notes

     GitGuardian SaaS adds Bitbucket Data Center integration, Workspace Audit Log, Incident bulk actions, and Viewer role.

     • Adds Bitbucket Data Center support for secrets detection monitoring
     • Introduces an Audit log section in settings for centralized user activity tracking
     • Enables bulk actions (resolve, ignore, assign) on Incidents
     • Adds a Viewer role with read-only access to all incidents

     4 details in Everything