GitGuardian Self-Hosted

No entries match these filters. Clear filters

1. changelog Oct 23, 2026 · issue 118

   Adds Wiz integration, per-source status filtering and views, unreachable-integration auto-recovery, beat.metricsPort Prometheus metrics, new public API endpoints (presence check, check-run skip), configurable ggshield API timeout, team perimeter settings, and audit log CSV secret-export detail.

   • New integrationAdds a Wiz integration that syncs active secret incidents from version control sources to Wiz daily as native secret findings, with detection context and a link back to GitGuardian (never the secret value); requires outbound HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. access to your Wiz tenant.
   • Adds source-status visibility — every source now shows Monitored, Unmonitored, Unreachable, Archived, or Deleted state — and lets you filter on that status from the perimeter page and incident list, and save it as a named view.
   • Updated integrationAdds automatic pause-and-resume for unreachable integrations (GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Confluence, Slack, and Microsoft Teams on Self-Hosted): real-time ingestion and historical scans pause when a token expires or a provider is unreachable, and resume automatically once reconnected.
   • Adds is all of operator to the source-status filter.
   • Adds beat.metricsPort config key so the task scheduler exposes Prometheus metrics, and the chart creates a ServiceMonitor for it when ServiceMonitors are enabled.

   +9 more show less

   • Adds public API endpoint to trigger a presence check.
   • Adds public API endpoints to find the GitHub check runs that reported an incident and to skip a blocking check run, enabling custom approval flows to unblock a pull request.
   • Adds author attribution for custom sources and coverage of Public Monitoring secrets (secret value and validity) to the public API.
   • Makes the ggshield API timeout configurable.
   • Allows GitLab system hook integrations configured with a non-admin token to monitor personal namespaces and project-only groups.
   • Adds two new team perimeter settings: keep unmonitored sources in teams, or remove archived sources from teams.
   • Adds secret-export detail to audit log CSV exports.
   • Enables developers to reply to a GitHub check run from a pull request with @gitguardian.
   • Extends global.podLabels to reach ClickHouse and Keeper pods, and extends global.* pod labels, annotations, node selectors, tolerations, priority class, and environment variables to migration jobs, upgrade-path check, remote preflight checks, and nginx CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. jobs.

   14 details in Everything

   • New detection v2.172 new detectors
   • Updated detection v2.172 improved detectors
   • New detection v2.172 new checkers
   • New detection v2.172 new analyzers
   • Updated detection v2.172 analyzer update
   • New detection v2.173 new detectors
   • Updated detection v2.173 improved detectors
   • New detection v2.173 new analyzer
   • Updated integration AI Hooks expanded to Amazon Kiro and Junie CLI
   • New supported platform Kubernetes 1.36 support
   └──▷ BREAKING ON UPGRADE

   • !Legacy analytics are removed in 2026.10: if in-app analytics are disabled on your instance, you must enable them before upgrading or your analytics dashboards will be lost.
   • !Background migrations must complete before an upgrade is accepted; attempting to upgrade while they run is refused with 'Not all required migrations have been applied' — wait for them to finish, then retry.
   • !Embedded cluster preflight checks now require at least 12 CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cores and 48 GiB of memory (up from 8 cores and 30 GiB); a smaller VM fails the check on upgrade.
2. 2026.10 - Required (2026-10-20) Oct 20, 2026 · issue 115

   Adds Wiz sync, source-status filtering, auto-pausing/resuming unreachable integrations, a beat.metricsPort Helm value for scheduler metrics, new public API endpoints for presence checks and GitHub check-run management, and expanded audit log CSV exports.

   • Adds beat.metricsPort Helm value to configure the port on which the task scheduler exposes Prometheus metrics, with automatic ServiceMonitor creation when ServiceMonitors are enabled.
   • New integrationAdds Wiz integration that syncs active secret incidents from version control sources to Wiz daily as native secret findings, including detection context and a link back to GitGuardian but never the secret value — requires outbound HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. to your Wiz tenant.
   • Adds source-status visibility: every source now displays one of Monitored, Unmonitored, Unreachable, Archived, or Deleted states, filterable from the perimeter page and incident list, with an is all of operator, and saveable as a named view.
   • Adds public API endpoint to trigger a presence check on a secret.
   • Adds public API endpoints to find the GitHub check runs that reported an incident and to skip a blocking check run, enabling custom approval flows to unblock pull requests.

   +10 more show less

   • Adds author attribution for custom sources and coverage of Public Monitoring secrets to the secret value and validity public API endpoints.
   • Adds configurable API timeout for ggshield via the API timeout setting.
   • Adds two new team perimeter settings to either keep unmonitored sources in teams or remove archived ones.
   • Adds audit log CSV exports that detail which secrets were exported.
   • Updated integrationUnreachable integrations (GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Confluence, Slack, Microsoft Teams) now automatically pause real-time ingestion and historical scans, surface a remediation step, and self-resume once the connection is restored.
   • Enables GitLab system hooks integrations configured with a non-admin token to monitor personal namespaces and project-only groups.
   • Enables developers to reply to a GitHub check run directly from a pull request using @gitguardian.
   • New embedded cluster installs deploy ClickHouse by default alongside PostgreSQL and Redis so analytics work out of the box.
   • Embedded cluster preflight checks now require at least 12 CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cores and 48 GiB of memory (raised from 8 cores and 30 GiB), failing smaller VMs without blocking upgrades.
   • Limits the license expiration banner to workspace owners, managers, and Admin Area users only, rather than all members.

   15 details in Everything

   • New detection 10 new detectors in Secrets Detection Engine v2.172
   • Updated detection 10 improved detectors in Secrets Detection Engine v2.172
   • New detection 2 new checkers with custom host support in v2.172
   • New detection 8 new analyzers in v2.172
   • Updated detection 1 analyzer update in v2.172
   • New detection 9 new detectors in Secrets Detection Engine v2.173
   • Updated detection 5 improved detectors in v2.173
   • New detection 1 new analyzer in v2.173
   • Updated integration AI Hooks extended to Amazon Kiro and Junie CLI
   • New supported platform Kubernetes 1.36 support
   └──▷ BREAKING ON UPGRADE

   • !Legacy analytics are removed on upgrade to 2026.10; if in-app analytics are disabled on your instance you must re-enable them before upgrading or your analytics dashboards will be lost.
   • !Embedded cluster preflight checks now require at least 12 CPU cores and 48 GiB of memory (up from 8 cores and 30 GiB); a smaller VM will fail the check.
   • !An upgrade to 2026.10 is refused with 'Not all required migrations have been applied' if background migrations from a prior release are still running; certain migrations must also complete on 2026.10 before upgrading to 2026.11.
   • !This is a required release and cannot be skipped.
3. changelog Oct 5, 2026 · issue 095
   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Check what share of your endpoint fleet has honeytoken decoy coverage after enabling the feature.
   📍In the GitGuardian console, go to Endpoints dashboard and locate the coverage card to view the percentage of fleet endpoints protected by the decoy AWS credential.
4. changelog Oct 4, 2026 · issue 094

   GitGuardian Self-Hosted adds honeytoken-based AWS credential decoy planting for endpoint credential-harvesting detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Enable honeytoken-based AWS decoy planting for endpoint protection — navigate to the Endpoints dashboard to verify fleet coverage after enabling.
   📍In the Endpoints dashboard, open the coverage card to review the share of your fleet protected by the decoy AWS credential. Requires Endpoint Protection, Honeytoken, and ClickHouse enabled on your instance.
   • Plants a decoy AWS credential in the file credential-harvesting malware reads first, triggering an alert that names the compromised endpoint when the honeytoken is used.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a coverage card to the Endpoints dashboard showing the share of your fleet protected by the decoy credential feature.

   2 details in Everything

5. changelog Sep 26, 2026 · issue 086

   GitGuardian Self-Hosted: Adds per-team incident permissions when promoting a user to Member, and extends linked Jira ticket comments to cover reassignment, regression, validity, access grants and revocations, public sharing, and feedback events.

   ⤢ ⤢ ⤢
   └──▷ USE IT
   Write in-app analytics to a non-public PostgreSQL schema when the database forbids the public schema or cannot grant broad privileges to the GitGuardian user.
   yaml copy

   inAppAnalytics:
     postgresql:
       applicationSchema: gitguardian_analytics
   useSeparateAnalyticsSchema: true
   analyticsSchema: gitguardian_analytics

   Pin the support bundle pod to a dedicated tainted node so bundle collection does not compete with workload pods.
   yaml copy

   replicated:
     supportBundle:
       nodeSelector:
         node-role: support
       tolerations:
         - key: dedicated
           operator: Equal
           value: support
           effect: NoSchedule
       affinity: {}

   └──▷ BREAKING ON UPGRADE

   • !The automatic Personal Access Token renewal system for Jira Data Center and Confluence Data Center integrations is removed. Before upgrading, manually update the token for every Jira Data Center and Confluence Data Center integration (sources and notifiers) with a long-lived PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. via the integration settings. An integration still relying on renewal will stop working when its token expires.
   • !ClickHouse is now rendered under clickhouse.* in the GitGuardian chart instead of the vendored clickhouse-server subchart. Any clickhouse-server.* values from 2026.8 must be moved to clickhouse.* before upgrading; the chart refuses to render while a clickhouse-server block is present. Object storage and backup settings move to clickhouse.objectStorage and clickhouse.backup, and clickhouse.serverConfig keys switch to camelCase.
   • !Argo CD installations that do not use an outbound proxy will see 1 resources require pruning and stay OutOfSync after upgrade, because the chart no longer creates the gim-proxy and gim-migration-proxy Secrets when no proxy URL is set. Resolve by running argocd app sync <app> --prune or enabling automated pruning.
   • !ggscout outside the cluster must be upgraded to 0.32.0 or later; earlier versions do not classify collected secrets with the Secrets Detection Engine.
6. 2026.9 (2026-09-25) Sep 25, 2026 · issue 086

   GitGuardian Self-Hosted 2026.9 adds Bridge networking, honeytoken endpoint protection, AI hooks for Codex and Mistral Vibe, and vaulted-secret classification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Route in-app analytics writes to a dedicated PostgreSQL schema when the GitGuardian database user cannot create objects in public.
   yaml copy

   inAppAnalytics:
     postgresql:
       applicationSchema: gganalytics
   useSeparateAnalyticsSchema: true
   analyticsSchema: gganalytics

   Schedule the support bundle collection pod onto a tainted node so it does not compete with production workloads.
   yaml copy

   replicated:
     supportBundle:
       nodeSelector:
         node-role: ops
       tolerations:
         - key: ops
           operator: Exists
           effect: NoSchedule
       affinity: {}

   • Adds GGBridge.bridges Helm values key to declare GitGuardian Bridge servers, enabling scanning of sources in isolated networks (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ a GitLab instance behind a firewall) without opening inbound connections.
   • Adds inAppAnalytics.postgresql.applicationSchema, useSeparateAnalyticsSchema, and analyticsSchema Helm/config keys so in-app analytics can write to custom PostgreSQL schemas instead of public.
   • Adds replicated.supportBundle.nodeSelector, tolerations, and affinity Helm keys to schedule the support bundle pod on specific or tainted nodes.
   • Adds mcpServer.oauth.extraRedirectUris Helm key to register a custom MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway as an OAuth callback.
   • Adds clickhouse.objectStorage and clickhouse.backup Helm keys (replacing clickhouse-server.* subchart values) as structured storage config under the new first-party clickhouse.* key.

   +10 more show less

   • Adds honeytoken protection for endpoints: ggshield plants a decoy AWS credential in credential-harvesting malware read paths, with fleet coverage tracked in the Endpoints dashboard (requires Endpoint Protection and ClickHouse).
   • Extends AI Hooks to block secrets inside Codex and Mistral Vibe, alongside existing Claude Code, Cursor, Copilot CLI, and VS Code support; adds a new inventory of AI agents and MCP servers per endpoint (requires ggshield 1.54.0+).
   • Adds vaulted-secret classification: ggscout now runs the Secrets Detection Engine on every collected value, enabling NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. inventory filtering by detector, detector type, secret family, category, and provider (requires ggscout 0.32.0+).
   • Adds ClickHouse health coverage to the Admin Area Health check page, admin banner, and notification emails, including HTTP reachability, metadata volume fill level against a configurable threshold, and backup freshness from the backup sidecar.
   • Adds Prometheus metrics with recommended thresholds and alerts for ClickHouse and the backup sidecar, and includes their logs and collectors in the support bundle.
   • Adds a configurable validity-check mode that omits a detector's default public host and checks secrets only against custom hosts, supporting air-gapped networks.
   • GitHub app installations made outside the dashboard (e.g. from the app's public GitHub page) now queue for Owner or Manager approval on the GitHub / GitHub Enterprise Server settings page instead of joining the monitored perimeter automatically.
   • Adds 6 new detectors in Secrets Detection Engine v2.170: Firebase ID Token, Coze Access Token, Keycloak Access Token, Keycloak Refresh Token, Fish Audio API Key, and Azure Custom Vision Training Key.
   • Adds 2 new analyzers in Secrets Detection Engine v2.171: Akamai API Credentials and Docker Credentials.
   • Adds 1 new analyzer in Secrets Detection Engine v2.170: Apify Token.
   • Adds GGBridge.bridges Helm values key to declare GitGuardian Bridge servers, enabling scanning of sources in isolated networks (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ a GitLab instance behind a firewall) without opening inbound connections.
   • Adds inAppAnalytics.postgresql.applicationSchema, useSeparateAnalyticsSchema, and analyticsSchema Helm/config keys so in-app analytics can write to custom PostgreSQL schemas instead of public.
   • Adds replicated.supportBundle.nodeSelector, tolerations, and affinity Helm keys to schedule the support bundle pod on specific or tainted nodes.
   • Adds mcpServer.oauth.extraRedirectUris Helm key to register a custom MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway as an OAuth callback.
   • Adds clickhouse.objectStorage and clickhouse.backup Helm keys (replacing clickhouse-server.* subchart values) as structured storage config under the new first-party clickhouse.* key.

   +7 more show less

   • Adds honeytoken protection for endpoints: ggshield plants a decoy AWS credential in credential-harvesting malware read paths, with fleet coverage tracked in the Endpoints dashboard (requires Endpoint Protection and ClickHouse).
   • Adds ClickHouse health coverage to the Admin Area Health check page, admin banner, and notification emails, including HTTP reachability, metadata volume fill level against a configurable threshold, and backup freshness from the backup sidecar.
   • Adds Prometheus metrics with recommended thresholds and alerts for ClickHouse and the backup sidecar, and includes their logs and collectors in the support bundle.
   • Adds a configurable validity-check mode that omits a detector's default public host and checks secrets only against custom hosts, supporting air-gapped networks.
   • Adds 6 new detectors in Secrets Detection Engine v2.170: Firebase ID Token, Coze Access Token, Keycloak Access Token, Keycloak Refresh Token, Fish Audio API Key, and Azure Custom Vision Training Key.
   • Adds 2 new analyzers in Secrets Detection Engine v2.171: Akamai API Credentials and Docker Credentials.
   • Adds 1 new analyzer in Secrets Detection Engine v2.170: Apify Token.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Jira Data Center and Confluence Data Center: the automatic PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. renewal system is removed. Every Jira Data Center and Confluence Data Center integration (sources and notifiers) must be updated with a long-lived PAT in the integration settings before upgrading, or the integration will stop working when its current token expires.
   • !ClickHouse (Helm installations): clickhouse-server.* subchart values are replaced by clickhouse.*. Any clickhouse-server.* block must be migrated to clickhouse.* before upgrading — the chart refuses to render while a clickhouse-server block is present. Object storage and backup settings move to clickhouse.objectStorage and clickhouse.backup; clickhouse.serverConfig keys switch to camelCase.
   • !Argo CD installations: proxy Secrets gim-proxy and gim-migration-proxy are no longer created when no proxy URL is set, leaving the previously created Secrets behind. The sync ends with '1 resources require pruning' and the application stays OutOfSync until you prune (e.g. argocd app sync <app> --prune).
   • !ggscout minimum version moves to 0.32.0; earlier versions will not classify collected secrets with the Secrets Detection Engine.
7. changelog Sep 8, 2026 · issue 068

   Self-hosted gains real-time validity check processing and AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. identity linking for secrets stored in vaults and Kubernetes.

   ⤢ ⤢ ⤢
   • Validity check results and incident creation events are now processed immediately on self-hosted instead of queuing.
   • AWS access keys stored in a secrets manager, Vault, or Kubernetes are now linked to their AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. identity in the NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. identity map.

   2 more in Everything

8. changelog Aug 31, 2026 · issue 060

   GitGuardian Self-Hosted 2026.8.0 adds ClickHouse analytics, an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, custom validity via API, AI-powered incident search, and 25+ new secret detectors.

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Enable Plain-English AI Filters for incident search on a self-hosted workspace after connecting an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider.
   📍In the dashboard, go to Settings › Workspace › AI and enable the External LLM toggle, then configure a reachable LLM provider. The AI Filters option will appear in the unified filter bar on the Incidents page.
   • Adds clickhouse-backup sidecar and ClickHouse as an optional in-cluster column-oriented database (StatefulSet backed by S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. object storage) deployable via Helm or KOTS, powering Endpoint Protection analytics; becomes mandatory in 2027.1.0.
   • Adds a GitGuardian Remote MCP server deployment (Helm only, beta, disabled by default) that runs in-cluster so no traffic or secrets leave the network — point Claude, Cursor, or any MCP client at the instance to scan for leaked credentials, manage incidents, and deploy honeytokens from the IDE.
   • Adds a Set your own validity status API call that accepts valid or invalid for secrets on internal systems GitGuardian cannot reach; incidents display Custom validity with the date set, recorded in the incident activity log and audit log.
   • Enables the unified filter bar on self-hosted, supporting incident search by secret value, commit author, or file path; Plain-English search (AI Filters) activates once a workspace administrator enables the External LLM toggle under Settings > Workspace > AI.
   • Adds Personal Access Token and Service Account Token creation through the public API for automated rotation workflows.

   +16 more show less

   • Adds the Only use detectors with validators option as settable on custom sources through the public API.
   • Adds a new Azure DevOps extension that inserts a ggshield scan job into every pipeline in an organization via a single pipeline decorator.
   • Adds a dedicated GitHub check runs page in the Perimeter section showing status, repository, commit, and linked pull request, with in-dashboard re-run or skip actions.
   • Adds @-mention support for members and teams in incident notes and feedback, triggering email notifications on both Internal and Public Monitoring incidents.
   • Adds automatic monitoring and automatic scan toggles for Jira Cloud, Jira Data Center, Confluence Cloud, Confluence Data Center, and Microsoft Teams sources.
   • Adds tunable emptyDir volume limits for the ml-secret-engine pod in the Helm chart.
   • Scans triggered via a Personal Access Token now emit an audit log event.
   • Adds 11 new detectors in v2.167: Azure SQL Credentials, Azure Machine Learning Key, Azure Video Indexer Key, Azure Health Insights Key, Azure Fluid Relay Key, LiteLLM API Key, DashScope API Key, Apify Proxy Token, Authress Access Key, and two Gemfury token variants.
   • Adds 6 new or upgraded checkers in v2.167: LiteLLM Without Host, LaunchDarkly SDK Key, Llama Cloud API Key, New Relic APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. License Key, npm Token, Hume AI API Key.
   • Adds 4 new detectors in v2.168: Azure Immersive Reader Key, DashScope Coding Plan API Key, DashScope Token Plan API Key, Prefect Cloud API Key.
   • Adds 2 new checkers in v2.168: Alibaba Cloud IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., GitLab Deploy Token.
   • Extends HTML/Markdown scanning in v2.168 to npm, GitHub Personal Access, GitHub OAuth, GitHub App, and Slack Application tokens.
   • Adds 7 new detectors in v2.169: Slack Webhook Trigger URL, n8n API Key, Atlassian Auth Key, AWS Cognito Access Token, OpenAI Access Token, Vercel OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Token, OpenCode API Key.
   • Adds 1 new checker in v2.169: Supabase Service Role JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store..
   • Adds 2 new detectors in v2.169.1: Lovable Access Token, Lovable Git Token.
   • Adds fine-grained GitHub personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. support for private members monitoring in the Public Monitoring perimeter.

   21 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Display as Tree view is removed from integration source pages.
   • !ClickHouse is optional in 2026.8 but becomes mandatory in 2027.1.0, requiring object storage (S3-compatible; Azure Blob Storage and GCS in progress) to be provisioned before upgrading to that release.
   • !The Grafbase Access Token detector is removed and the Amadeus OAuth Credentials detector is disabled, as both services were discontinued.
9. 2026.8 (2026-08-27) Aug 27, 2026 · release notes

   ClickHouse support, incident @mentions, custom validity API, unified AI search, and new secret detectors in v2026.8

   └──▷ HOW TO FIND IT
   Review and manage GitHub check run statuses directly in the UI without leaving the GitGuardian dashboard.
   📍Navigate to Perimeter › Check runs, then use the filter bar to search by repository or commit.
   • ClickHouse deployed as an optional in-cluster column-oriented database for fast analytics, starting with Endpoint Protection
   • New /check-runs page in the Perimeter section to filter, re-run, or skip GitHub check runs and jump to detected incidents
   • @ mention support in incident notes to notify members or teams by email
   • Unified filter bar with plain-English AI search enabled on self-hosted (requires External LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. toggle)
   • 15 new detectors added across engine versions v2.167–v2.169.1, including Azure SQL Credentials, LiteLLM API Key, and OpenAI Access Token

   5 details in Everything

10. changelog Jul 31, 2026 · issue 031

    GitGuardian Self-Hosted 2026.7 adds Public Monitoring, native Gerrit scanning, Smart Notifiers, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, and 9 new secret detectors.

    └──▷ USE IT
    Enable the Public Monitoring worker so your self-hosted instance processes public perimeter secret-leak incidents.
    yaml copy

    celeryWorkers:
      public-monitoring:
        enabled: true

    Deploy the GitGuardian MCP server in your cluster to expose the beta MCP endpoint.
    yaml copy

    mcpServer:
      enabled: true

    Disable migration-log sidecar collection on a Kubernetes cluster older than 1.29 to prevent upgrade failures.
    yaml copy

    logCollector:
      collectMigrationLogs: false

    • Adds Public Monitoring on self-hosted instances (license-gated): monitor your public perimeter for secret leaks and route public incidents through webhooks, Slack, Microsoft Teams, ServiceNow, and email alerts filterable by public incident severity.
    • Adds native Gerrit VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. source with full historical scanning, real-time detection via the webhook plugin, and read-replica support for cloning.
    • Introduces Smart Notifiers: define per-channel rules to filter alerts, tickets, or emails by severity, validity, secret type, or GitGuardian tag across internal and public monitoring.
    • GitHub check runs now scan oversized pull requests by cloning the repository branch instead of calling the GitHub API commit-by-commit, with configurable size thresholds and the ability to skip merge commits to protect shared API rate limits.
    • Supports routing external traffic through the Kubernetes Gateway API instead of the legacy Ingress resource, with Kubernetes HPA or KEDA autoscaling for webapps.

    +7 more show less

    • Adds 9 new secret detectors (Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, and five Azure services: Maps, Mixed Reality, Service Bus, Quantum, Bot Direct Line) and 2 new checkers (Gemfury Deploy/Push Token, Gemfury Full Access Token).
    • Jira Notifier now exposes remediation guidance and detector-specific links as assignable fields in the ticket description template.
    • Adds a Custom Sources (BYOS) option to scan with validated detectors only.
    • Adds a new opt-in mcpServer Helm deployment to run the GitGuardian MCP server in your cluster (currently in beta).
    • The daily analytics job can now write Spark scratch data to a dedicated ephemeral volume instead of the node's local disk, preventing failures from ephemeral-storage limits on large workspaces.
    • Incident assignment now auto-grants access to the assignee.
    • logCollector.collectMigrationLogs is now enabled by default, injecting a native sidecar to collect logs from pre-deploy and post-deploy hook Jobs (requires Kubernetes 1.29 or later).

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !logCollector.collectMigrationLogs is enabled by default and requires Kubernetes 1.29 or later; clusters running older Kubernetes versions will break unless logCollector.collectMigrationLogs: false is set before upgrading.
    • !Developer Endpoint Protection is not functional on self-hosted instances in this release; installations relying on Endpoint Protection will lose that capability on upgrade.
11. 2026.7 - Required (2026-07-24) Jul 24, 2026 · issue 024

    GitGuardian Self-Hosted 2026.7 adds Public Monitoring, native Gerrit scanning, Smart Notifiers, Gateway API routing, and 9 new secret detectors.

    └──▷ USE IT
    Enable the Public Monitoring worker in your Helm values to start processing public perimeter secret-leak incidents.
    yaml copy

    celeryWorkers:
      public-monitoring:
        enabled: true

    Deploy the GitGuardian MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server in your cluster (beta) by enabling it in your Helm values.
    yaml copy

    mcpServer:
      enabled: true

    • Adds Public Monitoring on self-hosted instances (license-gated): monitor your public perimeter for secret leaks and route public incidents through custom webhooks, Slack, Microsoft Teams, ServiceNow ticketing, and severity-filtered email alerts via the new celeryWorkers.public-monitoring worker.
    • Adds native Gerrit VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. source with full historical scanning, real-time detection via webhook plugin, and read-replica support for cloning.
    • Adds Smart Notifiers: define per-channel rules to filter alerts, tickets, and emails by severity, validity, secret type, or GitGuardian tag across internal and public monitoring.
    • GitHub check runs now scan oversized pull requests by cloning the repository branch instead of calling the GitHub API commit-by-commit, and can skip merge commits to protect shared API rate limits; thresholds and behavior are configurable from the admin area GitHub preferences.
    • Adds Gateway API routing to direct external traffic through the Kubernetes Gateway API instead of the legacy Ingress resource, plus support for HPA or KEDA autoscaling for webapps.

    +5 more show less

    • Secrets Detection Engine v2.166 adds 9 new detectors: Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, and five Azure services (Maps, Mixed Reality, Service Bus, Quantum, Bot Direct Line), plus 2 new checkers (Gemfury Deploy/Push Token, Gemfury Full Access Token).
    • Jira Notifier now exposes remediation guidance and detector-specific links as assignable fields in the ticket description template.
    • Custom Sources (BYOS) gain an option to scan with validated detectors only.
    • The daily analytics job can now write Spark scratch data to a dedicated ephemeral volume instead of the node's local disk, preventing failures on large workspaces.
    • Adds opt-in mcpServer deployment (Helm only, beta) to run the GitGuardian MCP server in-cluster; disabled by default.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Helm installations: logCollector.collectMigrationLogs is now enabled by default and injects a native sidecar requiring Kubernetes 1.29 or later; on older clusters you must set logCollector.collectMigrationLogs: false.
    • !Endpoint Protection (Developer Endpoint Protection) is not functional on self-hosted instances in this release — do not upgrade if you rely on Endpoints without contacting GitGuardian support first.
12. 2026.6 (2026-06-19) Jun 19, 2026 · issue 014

    GitGuardian Self-Hosted 2026.6 adds 20+ new secret detectors, a premium scan retry worker, Teams granular alerting, and open-source AI agent skills.

    └──▷ USE IT
    Route failed large-repository VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. scans to a dedicated high-memory pod so base scanner pods stay small and only heavy retries scale up.
    yaml copy

    # In your Helm values file, enable the premium scan retry worker:
    premiumScanRetryWorker:
      enabled: true
      resources:
        requests:
          memory: "8Gi"
        limits:
          memory: "16Gi"
      replicaCount: 1

    Receive only high-severity incident notifications in a dedicated Teams channel instead of all alert types.
    📍In the GitGuardian console, go to Integrations › Microsoft Teams, select a channel, then under Alert types enable only the specific incident event types (e.g. Incident opened, Severity: critical) relevant to that channel.
    • New premium scan retry worker (Helm only): routes failed large-repo VCS scans to a dedicated high-memory, scale-to-zero pod, keeping base scanner pods small.
    • New open-source agent-skills repository (GitGuardian/agent-skills) teaches AI coding assistants (Claude Code, Cursor) when to scan, how to read findings, and how to guide developers through remediation.
    • Secrets Detection Engine v2.163 adds 6 new detectors: Aikido API OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Credentials, Logflare Access Token, PolyAPI API Key, Apollo.io API Key, AES Cipher Key, and SAP OAuth Credentials.
    • Secrets Detection Engine v2.164 adds 6 new detectors: Authentik API Token, Pagar.me Encryption Key, Adobe Refresh Token, LiteLLM API Key, brapi.dev API Key, and Open VSX Access Token, plus a new Google OAuth2 Keys checker and Adafruit IO API Key analyzer.
    • Secrets Detection Engine v2.165 adds 8 new detectors (Stitch API Key, ActiveMQ Credentials, Instantly API Key, Gitea Access Token, Fal.ai API Key, SurrealDB Cloud JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Token, Kimi API Key, Wiz OAuth Credentials) and 8 new checkers including Okta, Azure, AWS Cognito, LaunchDarkly, Pulumi, and PyPI.

    +4 more show less

    • Microsoft Teams granular alerting: subscribe individual channels to specific incident event types for fine-grained notification control.
    • Jira Cloud integration switches from webhooks to recurrent scanning; VCS historical scans now cover orphaned commits, Git notes, and pull/merge request refs.
    • Overview analytics now include Non-Human Identities (NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.); GitHub check runs can skip merge commits; Jira/ServiceNow tickets can be dissociated from incidents; GitLab read-only group hook tokens supported.
    • Updated system requirements: Kubernetes 1.30+ (1.35 recommended), PostgreSQL 15+ (17 recommended), Redis 6+ (7 recommended), ggscout 0.19.0+, KOTS 1.117.3+.

    9 details in Everything

13. 2026.6 (2026-06-19) Jun 19, 2026 · release notes

    GitGuardian Self-Hosted 2026.6 adds premium scan retry worker, agent skills, 19 new detectors, and granular Teams alerting.

    └──▷ TRY IT
    Clone the new agent skills repo to integrate with local AI tools for automated remediation guidance.
    copy

    $ git clone https://github.com/GitGuardian/agent-skills.git && ls agent-skills

    Configure granular Teams notifications for specific incident types via the UI.
    📍In the console, go to Settings › Integrations › Microsoft Teams and enable granular alerting for specific incident event types per channel.
    • Adds Premium scan retry worker (Helm-only optional deployment) to route large, OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process.-prone VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. scans to a dedicated high-memory pod, keeping base workers small.
    • Ships open-source GitGuardian/agent-skills repository to teach AI coding assistants how to scan, read findings, and remediate secrets via ggshield.
    • Introduces 19 new secret detectors across engine versions v2.163–v2.165, including Aikido API OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Credentials, Authentik API Token, Stitch API Key, and others.
    • Adds granular Microsoft Teams alerting for internal monitoring, allowing subscription to specific incident event types per channel.
    • Enables Jira Cloud recurrent scanning (replacing webhooks) and extends VCS historical scans to cover orphaned commits, Git notes, and pull/merge request refs.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Updates minimum system requirements for Self-Hosted deployment: KOTS 1.117.3+, Kubernetes 1.30+, PostgreSQL 15+, Redis 6+; Helm values require review for compatibility.
    • !The sap_ai_core_credentials detector is replaced by the new SAP OAuth Credentials checker in engine v2.165.
14. 2026.5 (2026-05-21) May 21, 2026 · release notes

    GitGuardian 2026.5 adds advanced analytics dashboard, NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. governance flags, AI workspace settings, Atlassian attachment scanning, Slack capabilities, and Secrets Detection En

    └──▷ HOW TO FIND IT
    Enable external LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. calls and configure BYOCBYOCBring Your Own Cloud — a deployment model where the end user supplies the cloud infrastructure instead of the vendor, letting cyber tools run inside the customer's own environment for data-residency or compliance reasons. for the AI workspace via the UI.
    📍Navigate to Settings → Workspace → AI in the GitGuardian self-hosted console to toggle external LLM calls and select AWS Bedrock as the provider.
    Update Slack bot scopes to enable attachment scanning and redaction without reinstalling the app.
    📍Add channels:history (for private channel names), im:history, and file-related scopes to the existing GitGuardian Slack app's Bot Token Scopes in the Slack App Management dashboard.
    Configure log level for support bundle generation to filter Loki queries.
    yaml copy

    Add the following key to your Helm values or config:
    logCollector.supportBundle.logLevel: "info"

    • Enables Advanced Analytics by default on Helm installations with the new Analytics Overview page aggregating Protect, Detect, Remediate, and Govern KPIs
    • Adds AI workspace setting for self-service enable/disable of external LLM calls and BYOC provider configuration (AWS Bedrock) at Settings → Workspace → AI
    • Introduces NHI admin and overprivileged flags in NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems. to flag non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. across AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege., Microsoft Entra, and Okta with automatic severity bumping for admin breaches
    • Extends attachment scanning to Jira Cloud, Jira Data Center, Confluence Cloud, and Confluence Data Center (requires reinstall of Atlassian integrations for new scopes)
    • Adds Slack file attachment scanning, interactive thread responses (beta), and private channel name redaction by updating Bot Token Scopes in the existing Slack app

    +2 more show less

    • Upgrades Secrets Detection Engine to v2.161 with 7 new detectors, 1 checker, and 5 analyzers for credentials like Payhere, HubSpot, Datadog, and GitGuardian tokens
    • Upgrades Secrets Detection Engine to v2.162 with 16 new detectors, 6 detector updates, and 3 analyzer updates covering Aikido, Baidu, Bitrise, Canva, Cloudflare, and other keys

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated Honeytoken Labels Public API has been removed (use Custom Tags)
15. 2026.4 - Required (2026-04-22) Apr 22, 2026 · release notes

    Email verification MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., ggshield real-time AI coding tool scanning, and in-cluster support bundle generation

    └──▷ HOW TO FIND IT
    Generate a support bundle directly from the browser without kubectl access
    📍Go to Admin area › Support Bundle page in the Self-Hosted console
    Configure Helm to prevent Replicated from patching Secrets for strict admission policies
    yaml copy

    replicated.readOnlyMode: true

    • Adds email-based MFA requiring verification codes at login and before sensitive workspace actions for email/password users
    • Adds ggshield real-time scanning of prompts, tool calls, and agent actions for Cursor, Claude Code, and GitHub Copilot
    • Adds Team perimeter scoping for non-VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. sources (container registries, messaging, docs, tickets, package registries) via Incident visibility settings
    • Adds in-cluster support bundle generation from Admin area > Support Bundle page, eliminating kubectl or Krew plugin requirements
    • Adds 16 new detectors/checkers including Polar Organization Access Token, Microsoft Azure Storage Account Key, and DeepL keys to detection engine v2.159

    +9 more show less

    • Adds 5 new checkers for Kubernetes Docker Secrets and Private Keys with GitLab/GitHub registration checks in detection engine v2.160
    • Brings location.url field support and v2 format tokens for Personal/Service Accounts to Bring Your Own Sources
    • Sets Critical saved view as default and adds severity rule ID/detector category fields to incidents
    • Adds /v1/severity-rules endpoint and historical scan trigger/cancel endpoints to public API
    • Adds workspace-level privacy mode enforcement and exposes audit log event types via public API
    • Adds namespace-scoped NetworkPolicyNetworkPolicyA Kubernetes API object that defines which pods may send or receive traffic, enforced by the cluster's CNI plugin to give cyber tools namespace-level network segmentation without host firewall rules. support configurable via networkPolicy.* Helm values with dryrun → enforce rollout
    • Makes manual encryption secret creation required for new Helm installations
    • Bundles JSON schemas into the deployment package for air-gapped environments
    • Adds replicated.readOnlyMode to prevent Replicated subchart from creating/patching Secrets

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removes built-in support for externalSecrets in Helm installations; users must switch to existingSecrets and manage ExternalSecret resources manually
16. 2026.3 (2026-03-16) Mar 16, 2026 · release notes

    GitGuardian 2026.3 adds JFrog/Quay integrations, ~30 new detectors, and a public API for egress IPs.

    • Adds support for scanning JFrog Artifactory package registries (Maven, npm, PyPI, NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code., Go, and more) with historical and incremental scanning.
    • Adds Red Hat Quay integration for detecting secrets in container images across quay.io and self-hosted deployments, with full image layer analysis and OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. authentication.
    • Adds the Okta Integration Network integration for one-click SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, and Group Push.
    • Adds 30 new secret detectors (v2.157/v2.158) including WooCommerce, Iyzico, Mercado Pago, Bitbucket HTTP Access Token, PostgreSQL, MariaDB, Azure Event Hub, Azure Container Registry, Coralogix, Azure Web PubSub, Azure Batch, Azure APIM Gateway, Azure IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Provisioning, Azure AI Search, GitLab CI/CD Job Token, PostHog, MiniMax, Retell, Azure Storage Account Key, Curl Username Password.
    • Adds 4 new revokers for SendGrid, Slack User Token, Slackbot, and Heroku.

    +4 more show less

    • Adds a public API endpoint for retrieving GitGuardian egress IP addresses.
    • Adds customizable session duration for dashboard sessions.
    • Adds the ability for workspace managers to restrict Personal Access Token scopes for members.
    • Adds filename and line number fields to Jira templates.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Embedded cluster installations running 2026.2.0 must manually delete the replicated PodDisruptionBudget before upgrading.
17. 2026.2 (2026-02-23) Feb 23, 2026 · release notes

    GitGuardian 2026.2 adds Dark Mode UI, new detectors via Secrets Engine v2.156, and optional worker-check-runs

    • Dark Mode interface added under Account → Interface → Theme for cleaner layouts and improved contrast.
    • Secrets Detection Engine v2.156 adds coverage for Modelscope, Proxmox, ZegoCloud, Deepgram, Microsoft Power Apps Webhook, Mem0, and Obsidian detectors.
    • worker-check-runs optional worker introduced to offload check_run processing from worker-worker, enabled via Helm config.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Kubernetes minimum version raised to 1.30 (EOL); upgrade to 1.35 recommended for stability.
    • !Argo CD deployments now require a pre-created encryption secret before installing or upgrading.
18. 2026.1 - Required (2026-01-28) Jan 28, 2026 · release notes

    GitGuardian 2026.1 adds NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. integrations (Datadog, Snowflake, Okta, Auth0), GCP Marketplace deployment, enriched secret names, and Unified Identity Governance for Entra/AWS.

    • Secret Enricher now provides ML-powered generic incident details displaying enriched secret names
    • More NHI Integrations supports non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. discovery across Datadog, Snowflake, Okta, and Auth0
    • Unified Identity Governance offers risk-based prioritization for Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. and AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. with secret-less OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication
    • Google Cloud Marketplace availability enables GitGuardian deployment on GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. with consolidated billing
    • Secrets Detection Engine v2.153 includes 6 new detectors (HighLevel, Elastic, Google Cloud Keys, Socket Dev, Upstash Redis, Vapid Key)

    +4 more show less

    • Secrets Detection Engine v2.154 adds 3 new detectors (Cloudflare R2, Azure SAS URL, MySQL) and 1 new checker (Tailscale SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.)
    • Secrets Detection Engine v2.155 includes 18 new detectors including Oracle, Azure Entra App Secret, GitLab SCIM, and MongoDB
    • Incident API now returns enriched secret names in CSV/JSON exports
    • Detector settings include a Recommended for business filter to identify non-business detectors disabled by default

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !KOTS Embedded installations must manually delete the PostgreSQL StatefulSet before upgrading to 2026.1
19. 2025.12 (2025-12-15) Dec 15, 2025 · release notes

    GitGuardian 2025.12 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, CyberArk integration, in-app analytics beta, and multiple hostname support

    • Adds extra_hostnames Helm parameter to define additional domain names for self-hosted access
    • Adds SCIM team provisioning integration with Okta and Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.
    • Adds CyberArk Secrets Manager Self Hosted integration for non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. enumeration
    • Enables advanced analytics dashboards for secret leak monitoring when enabled via inAppAnalytics.enabled Helm value or KOTS Admin Console toggle
    • Adds support for Helm v4

    +2 more show less

    • Adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support via the network.ipFamily parameter for Service resources
    • Adds global podDisruptionBudget.enabled Helm parameter to disable automatic PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis. creation

    7 details in Everything

20. 2025.11 Nov 19, 2025 · release notes

    GitGuardian Self-Hosted 2025.11 updates secret detection, adds PostgreSQL 18 and Redis 8 support, and improves incident navigation.

    • Adds a new Coveo API Key detector to the secrets detection engine
    • Improves the Resend secret detector coverage
    • Adds one new secrets detection checker.
    • Upgrades an analyzer within the secrets detection engine
    • Includes a detection engine enhancement in version 2.150.

    +6 more show less

    • Adds source links to incident list entries and exposes change_type field in API responses
    • Shows Dev-in-the-Loop incident IDs and adds dashboard navigation for these incidents
    • Adds official support for PostgreSQL 18 as a supported database version
    • Adds official support for Redis 8 as a supported cache version
    • Enforces terms and conditions acceptance requirement during self-hosted instance setup
    • Simplifies Helm configuration by having Replicated inherit global image pull secrets, removing the need for separate imagePullSecrets in the replicated section

    11 details in Everything

21. 2025.10 - Required (2025-10-27) Oct 27, 2025 · release notes

    New Microsoft Teams attachment scanning, unified leak graph, and incident-based secret revocation in GitGuardian Self-Hosted 2025.10

    • Adds Microsoft Teams attachment scanning to detect secrets in shared files within incidents.
    • Adds unified graph with public leak intelligence to correlate internal and public exposures.
    • Enables secret revocation directly from incidents via the new Secret Revocation workflow.
    • Adds Context preview for non‑VCS incidents to view surrounding content for leaks in SharePoint, OneDrive, and Confluence.
    • Adds ggshield vault name and path display to show secret manager details for vaulted secrets.

    +3 more show less

    • Updates Helm configuration to change the log collector MinIO image (see breaking changes).
    • Adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. cluster support for Helm deployments alongside existing AMD64 support.
    • Adds support for the read-only root filesystem constraint in container deployments.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading to Helm installations changes the MinIO image used in the log collector; you must update your Helm values file.
22. 2025.9 (2025-09-17) Sep 17, 2025 · release notes

    GitGuardian Self-Hosted 2025.9 adds BYO source scanning, AI filters, and SharePoint/OneDrive support

    └──▷ HOW TO FIND IT
    Quickly search across all incidents and logs using the new unified interface
    📍Press Ctrl+K (or Cmd+K) in the UI to open Quick Access, then type natural language queries.
    Filter audit logs using natural language instead of static fields
    📍In the Audit Logs view, use the AI Filters input box to type 'Show me failed authentication attempts from last week'.
    • Bring Your Own Sources capability extends secret detection to CI logs, legacy systems, and SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel.
    • Quick Access unified search interface enabled via Ctrl+K / Cmd+K shortcut
    • AI Filters allows natural language filtering for incidents, perimeter, and audit logs
    • New SharePoint and OneDrive scanning integrations for knowledge base secret detection
    • New detectors in Secrets Detection Engine v2.146 for Africa's Talking, Clipdrop, StackHawk, and Murf

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !KOTS installation is deprecated; users must migrate to Helm installation.
    • !System requirements updated: minimum Kubernetes 1.28/PostgreSQL 15/Redis 6 now recommended 1.32/16/7
23. 2025.8 (2025-08-18) Aug 18, 2025 · release notes

    GitGuardian Self-Hosted 2025.8 adds AWS ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. detection, Log Collector Helm values, custom webhook selection, Bitbucket Cloud API auth, Valkey support, and W&B/Bitbucket/Mercad

    • Adds image.registry parameter in Helm values to configure the Log Collector image location (Loki, MinIO, Fluent Bit) for air gap deployments.
    • Adds AWS ECR Container Registry detection for hardcoded secrets.
    • Adds 3 new secrets detectors: Weights & Biases, Bitbucket App Password, and Mercado Pago.
    • Enables granular event selection for custom webhooks.
    • Adds support for Bitbucket Cloud API token authentication in VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. monitoring.

    +1 more show less

    • Adds Valkey (Redis 7.2 fork) support for Redis-compatible deployments.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The required minimum versions have increased: KOTS 1.117.3, Kubernetes 1.28, PostgreSQL 15, Redis 6, ggscout 0.16.6.
24. 2025.7 - Required (2025-07-24) Jul 24, 2025 · release notes

    GitGuardian Self-Hosted 2025.7 adds Jira/Confluence DC historical scanning, ML engine default, v2.143 detectors, and custom tags API.

    • Adds Jira Data Center and Confluence Data Center historical scanning to scan past content for secrets
    • Enables the Machine Learning engine by default in 2025.7 with configurable pod priority for resource management
    • Introduces custom tags API key/value filtering and custom remediation links for workflow automation
    • Supports GitLab multi-hook configuration for enhanced integration flexibility
    • Implements auto-ignore invalid incidents playbook to automatically clear confirmed invalid secrets

    +4 more show less

    • Adds auto-resolve revoked secrets playbook capability
    • Introduces Jira DC leaker emails feature for targeted notifications
    • Improves JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. detection logic to only catch signed JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. across all detector types
    • Expands secret detection coverage with v2.143 adding 7 new detectors including GitLab Incoming Mail, Coze PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., Tavus, Heroku Platform, SSH with port, Tableau Cloud PAT, and Notion v2

    9 details in Everything

25. 2025.6 (2025-06-20) Jun 20, 2025 · release notes

    GitGuardian 2025.6 adds secret detection for Teams, Container Registries, Jira/Confluence history, and Splunk/Loki/Datadog log export.

    • Adds Microsoft Teams integration for real-time and historical secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. in messages
    • Adds Jira Cloud and Confluence Cloud historical scanning to detect past secrets
    • Adds Container Registries secret detection for Azure, Google, JFrog, and DockerHub
    • Enables Self-Hosted export of logs to Splunk, Loki, Elasticsearch, Kafka, and Datadog
    • Adds secure API access to secret values via a new endpoint for automation workflows

    +3 more show less

    • Adds Kubernetes constraint configuration to limit workers to one per node in deployments
    • Updates ggscout minimum version requirement to 0.16.6
    • Requires Kubernetes 1.28 as the new minimum supported version

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Kubernetes 1.27 is no longer supported; clusters must run at least 1.28
    • !ggscout versions below 0.16.6 are incompatible and must be upgraded
26. 2025.5 (2025-05-22) May 22, 2025 · release notes

    GitGuardian Self-Hosted 2025.5 adds ServiceNow scanning, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, customizable incidents view, and NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. policy filtering.

    └──▷ TRY IT
    Configure proxy credentials using Kubernetes secrets instead of plaintext config
    copy

    $ kubectl create secret generic gg-proxy-creds --from-literal=username=<proxy_user> --from-literal=password=<proxy_pass>

    Enable SCIM provisioning to sync users with Okta or Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. via the UI
    📍In the console, go to Settings › User Management › SCIM and configure the endpoint and token for your IdP.
    Create a custom view in the incidents interface to prioritize specific secret types
    📍In the console, go to Incidents › Views › Create Custom View and add properties like severity and repository
    • Adds ServiceNow secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. to detect secrets and honeytokens for automated incident tracking
    • Adds SCIM user provisioning integration with Okta and Microsoft Entra ID for automated onboarding/offboarding
    • Adds customizable incidents view allowing creation of custom views with specific properties for prioritization
    • Adds filtering, analytics, and Secret Reuse policy support to NHI Policies improvements

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Renamed images in this release for air gap deployments; users must update their tooling for downloading and uploading GitGuardian images to their private registry
    • !This release uses Chainguard images without FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments.-approved cryptographic modules; environments requiring FIPS must contact support
27. 2025.4 - Required (2025-04-25) Apr 25, 2025 · release notes

    GitGuardian Self-Hosted 2025.4 adds NHI GovernanceNHI GovernanceThe policies, controls, and lifecycle management applied to Non-Human Identities — service accounts, API keys, tokens, and certificates — to enforce least-privilege access and reduce credential sprawl across systems., custom tags, secrets scope enrichment, and log collector integration.

    • Adds NHI Governance feature to manage and secure Non-Human Identities with lifecycle management
    • Adds custom tags to categorize and filter incidents in the UI
    • Adds Secrets Analyzer scope, permission, and ownership details to detected secrets for risk assessment
    • Adds Log collector for Self-Hosted integration with Loki, MinIO, and Fluent Bit
    • Adds Jira DC incident filter support

    +1 more show less

    • Adds custom webhook payload configuration option

    6 details in Everything

28. 2025.3 (2025-03-20) Mar 20, 2025 · release notes

    GitGuardian 2025.3 adds Secret Enricher ML model, ggscout integrations for Jira and secret managers, and v2.133 detection engine.

    • Adds Secrets Managers integration to sync incidents with AWS, HashiCorp Vault, Azure, Google, Delinea, and Akeyless via ggscout
    • Adds Generic Secret Enricher — ML model that analyzes context to identify secret providers and categories with new filters
    • Adds Jira ticket templates with Incident ID variable for instant ticket creation
    • Adds Customizable Public API pagination maximum page size
    • Adds Automatic license synchronization for non-air-gap environments

    +3 more show less

    • Adds nodeSelector support in Helm jobs for enhanced node scheduling flexibility
    • Updates Secrets Detection Engine to v2.133 with 5 new detectors and 8 improved detectors
    • Updates Self-Hosted ggscout with Vault preflight checks, hardened Helm chart, Replicated Proxy support, embedded cluster deployment, and support bundle logs

    8 details in Everything

29. 2025.2 (2025-02-20) Feb 20, 2025 · release notes

    New Bitbucket Cloud scanning, custom tags API, enhanced email controls via API, and autoscaling support in v2025.2.

    • Search incidents by secret value enables monitoring secret leaks across thousands of repositories and sources.
    • Adds Bitbucket Cloud scanning capability for real-time detection of exposed credentials in Bitbucket repositories.
    • Introduces Custom Tags via API to organize incidents, with UI support noted as coming soon.
    • Enhances email incident alerting by allowing management of notification settings and account-level defaults via API.
    • Adds autoscaling support through HPA (Horizontal Pod Autoscaler) for web applications based on demand.

    5 details in Everything

30. 2025.1 - Required Jan 20, 2025 · release notes

    Adds Microsoft Teams alerts, Slack secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. deprovisioning, and configurable scan limits in GitGuardian Self-Hosted 2025.1

    • Adds Jira Data Center auto-tracking to auto-create issues, sync custom fields, and auto-resolve incidents.
    • Deploys False Positive Remover v1 ML model to halve false positives in Self-Hosted scans.
    • Enables Slack secret scanning to detect leaked secrets in full history of public and private channels.
    • Enhances remediation tracking with precise location details and real-time progress monitoring.
    • Adds scan_after_push_force_rate_limit preference to adjust the file tracking engine's scan rate limit.

    +7 more show less

    • Implements SCIM user deprovisioning to automatically remove users when they are deleted from the IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    • Introduces v2.128 secrets detection engine with new Jenkins API, chpasswd, Nessus Agent, and Statsig Server detectors.
    • Introduces v2.129 secrets detection engine with a new GitLab OAuth detector and improved Base64 High Entropy, GitGuardian Test Token, MSSQL, and Zendesk detectors.
    • Adds automatic repository monitoring control via the redesigned navigation menu.
    • Supports Jira Data Center user picker custom fields for integration configuration.
    • Improves GitHub integration handling for large patches (>100 commits) and enables configurable commit length scanning via repo_scan_max_commit_length.
    • Merges secrets_checks queue with background validity checks queue to optimize performance.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !PostgreSQL 13 and 14 are no longer supported. PostgreSQL 15 is the minimum; PostgreSQL 16 is recommended.
31. 2024.12.0 Dec 23, 2024 · release notes

    GitGuardian Self-Hosted 2024.12 adds Jira Data Center, GitLab instance integration, forked repo checks, secret pattern exclusions, and new worker metrics

    • Adds support for defining secret Secret pattern exclusion rules to hide secrets matching defined patterns from incidents.
    • Allows configuring an instance-level GitLab integration using a read-only admin token.
    • Enables GitGuardian check runs on GitHub forked repositories to improve code security coverage.
    • Workspace Managers can disable automatic repository monitoring in VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. integrations to control perimeter expansion.
    • Adds 7 new secret detectors: X-API Key Secret, Azure Functions App Key Header, Azure Functions App Key Query Parameter, Jenkins API token, chpasswd Username Password, Nessus Agent Key, and Statsig Server Secret Key.

    +2 more show less

    • Provides a Worker Tasks page in the Admin Area to monitor task activity and worker usage for scaling optimization.
    • Exposes new applicative metrics: gim_periodic_task_period_seconds, gim_periodic_task_not_run_for_seconds, gim_check_runs_long_running, gim_health_check_result_count, and gim_outdated_health_check_count.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The front.ingress Helm value has been renamed to ingress.
32. 2024.11.0 Nov 18, 2024 · release notes

    Confluence Data Center, ServiceNow integration, bulk historical scans, API scopes, and Helm parameter updates in GitGuardian Self-Hosted 2024.11.0

    └──▷ TRY IT
    Trigger an incident notification via API without sending an email.
    copy

    $ curl -X PATCH 'https://<your-instance>/api/sources/<source-id>' -H 'Authorization: Bearer <token>' -d '{"status": "monitored", "send_email": false}'

    • Adds spread_periodic_range_minutes to replace the deprecated settings.healthCheck.periodicInterval for distributing health checks over time.
    • Adds Confluence Data Center integration for real-time secret detection and honeytoken detection.
    • Adds ServiceNow integration to create, auto-create, and auto-resolve issues from GitGuardian incidents.
    • Adds a new Bulk Historical Scans Management page for tracking and filtering historical scans.
    • Adds sources:read and sources:write scopes for accessing Sources API endpoints.

    +4 more show less

    • Adds send_email parameter (true|false) to API endpoints triggering notifications to control email delivery.
    • Allows GitHub custom properties to override GitGuardian global configuration for check runs.
    • Adds option to deactivate members instead of deleting them.
    • Adds replicated.privateCASecret parameter in Helm values to specify a custom CA for proxy usage.

    9 details in Everything

33. 2024.10.0 Oct 21, 2024 · release notes

    GitGuardian Self-Hosted 2024.10.0 adds VS Code extension, occurrence grouping, filepath exclusions, and new detection engines.

    • ggshield is now available as a VS Code extension that scans files on save and displays highlighted secrets in the IDE
    • New grouping mode in Honeytoken Self-Hosted groups secret occurrences per secret x source for separate incident management
    • Filepath exclusions can now be scoped to specific repositories via configuration to reduce irrelevant incidents
    • Certificate-based authentication with CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. support added alongside multi-authentication for service access
    • New long-ods and long-ods-io worker types available in Embedded cluster for productivity tools and I/O tasks

    +1 more show less

    • Secrets detection engine upgraded to version 2.122.1 adding Atlassian Access Token, Bitbucket Access Token, and Mistral AI API Key detectors

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Users must upgrade KOTS to version 1.117.3 or later before upgrading GitGuardian
    • !Removed resources limits for Postgres and Redis on the Embedded cluster installation require manual review of previous configurations
34. 2024.8.0 Aug 20, 2024 · release notes

    GitGuardian Self-Hosted 2024.8.0 adds saved views, CAC/PIV auth, Helm updateStrategy config and API feedback_list

    • Adds updateStrategy configuration key to Helm values for customizing rolling upgrade strategy
    • Adds feedback_list field to secret incidents' API payload to expose user feedback via /v1/incidents
    • Supports CAC or PIV card certificate-based authentication (new architecture only)
    • Adds Saved views in the UI to save and quick-access frequently used filters for secrets
    • Adds progress estimation and comprehensive scan status details (size, duration, start/end dates, commits, branches, queue) for historical scans

    +3 more show less

    • Allows manual triggering of Health Checks from the GitGuardian dashboard
    • Enables skipping initial historical scan when installing a new GitLab Community Edition integration
    • Adds is_team_leader boolean attribute in API endpoints /v1/teams/{team_id}/team_memberships and /v1/teams/{team_id}/team_invitations to designate team owners

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The team_permissions field has been deprecated and replaced by the is_team_leader field in API endpoints /v1/teams/{team_id}/team_memberships and /v1/teams/{team_id}/team_invitations
35. 2024.7.0 Jul 17, 2024 · release notes

    GitGuardian Self-Hosted 2024.7.0 adds Confluence real-time detection, pending_timeout API status, and Celery monitoring metrics.

    • GET /v1/members and /v1/invitations now use the access_level field (replacing role).
    • API introduces pending_timeout scan status to distinguish queued scans from failed ones.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The role field is renamed to access_level in the API endpoints /v1/members and /v1/invitations.
36. 2024.6.0 Jun 17, 2024 · release notes

    GitGuardian Self-Hosted 2024.6 adds 14 new secret detectors, incidents API endpoint, and configurable platform health checks.

    • Adds sourcegraph_access_token_v3, duplo_cloud_api_key, fernet_key, vercel_blob_token, asp.net_decryption_key, asp.net_validation_key, langchain_api_key, openai_project_api_key, openai_service_account, sourcegraph_enterprise_subscription_token, sourcegraph_license_key_token, sourcegraph_user_gateway_access_token, nylas_api_key, and wakatime_api_key to the secrets detection engine (v2.114).
    • Adds a new API endpoint to query secret incidents for a specific source.
    • Enables periodic validity checks for previously ignored incidents.
    • Adds configurable platform health checks for VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures., Messaging, Ticketing, and Documentation integrations with hourly frequency control in the Admin Area.
    • Introduces email notifications for integration health check failures, controllable via email preferences.

    5 details in Everything

37. 2024.5.0 May 22, 2024 · release notes

    New detectors for Dropbox/Midtrans/Sanity/Zuplo/GrafanaCloud/Groq/Nx, Jira Cloud integration, Privacy mode, Argo CD support, and Helm config flags

    • Adds Dropbox Key, Midtrans API Key, Sanity Token, Zuplo API Key, Grafana Cloud API Key, Groq API Key, and Nx Cloud Token to the secrets detection engine (v2.111)
    • Activates Generic CLI Secret and Generic Database Assignment detectors by default for non-VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. data sources
    • Introduces Jira Cloud issue tracking integration with automatic incident creation, custom field support, and auto-resolve
    • Adds istio.gateway.enabled, migration resource labels/podLabels, and externalSecrets RefreshInterval to the Helm values file
    • Enables setting initial admin password from an existing secret in the Helm values

    +3 more show less

    • Supports Argo CD as an official data source integration
    • Introduces Privacy mode to obfuscate secrets on the GitGuardian UI
    • Allows deletion of the AI query history via Filters

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Renamed celeryWorkers.realtime_ods to celeryWorkers.realtime-ods in configuration
38. 2024.4.0 Apr 17, 2024 · release notes

    GitGuardian 2024.4.0 adds Jira Cloud honeytoken support, preflight script, and scalable worker-realtime-ods pod

    • Adds worker-realtime-ods pod to the deployment architecture for real-time scanning workloads.
    • Introduces a new preflight script in Helm releases to verify Kubernetes requirements before upgrade.
    • Shows secret identity card on each secret incident detail page.
    • Adds breakdown of secret incidents by severity in the sources API payload.

    4 details in Everything

39. 2024.3.0 Mar 19, 2024 · release notes

    Slack integration for secrets, AI filtering, GitHub label overrides, and signed images with new architecture support

    • slack integration is now supported for real-time secret detection and honeytoken detection on Self-Hosted.
    • The ai_filters_enabled option in the preferences enables AI filtering of secrets.
    • The check_runs_overrides_labels_ghe option in preferences allows overriding check run settings with repository labels on GitHub Enterprise Server.
    • GitGuardian images are now signed with Cosign, exclusive to the new architecture.

    4 details in Everything

40. 2024.2.0 Feb 20, 2024 · release notes

    GitGuardian 2024.2.0 adds CSV export tab separator, GitLab disabled group detection, and HTTP proxy support.

    └──▷ HOW TO FIND IT
    Export incidents as tab-separated values for easier parsing in spreadsheet tools
    📍In Admin › Settings › Export data, set the separator to Tab
    • Adds csv_separator option to incident exports, allowing tab-separated values instead of the default comma
    • Adds GitLab integration health check that detects when a group hook is disabled by GitLab
    • Adds HTTP proxy configuration support in KOTS and Helm installs for the new architecture
    • Adds Redis Sentinel support in KOTS and Helm installs in the new architecture
    • Adds multiple CA certificates concatenation support in KOTS install in the new architecture

    +1 more show less

    • Adds SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. server support for self-signed certificates via a new configuration option

    6 details in Everything

41. 2024.1.1 Jan 17, 2024 · release notes

    GitGuardian 2024.1.1 adds 8 new secret detectors, source criticality prioritization, Chainguard images, and SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure./SMTP TLS support.

    └──▷ TRY IT
    Ensure the required PostgreSQL extension is present before upgrading to avoid downtime.
    copy

    $ psql -U gitguardian -d gitguardian -c "CREATE EXTENSION IF NOT EXISTS btree_gin;"

    • Adds base64_aws_iam_key, base64_aws_ses_key, readme_api_key, tailscale_api_key, tailscale_oauth_key, tailscale_preauth_key, tailscale_scim_key, and tailscale_webhook_key to the secrets detection engine v2.102
    • Adds a new source-level parameter for prioritizing Secret incidents in GitGuardian Self-Hosted
    • Switches default images to Chainguard-based builds (KOTS admin 1.104.4 and Replicated SDK 1.0.0-beta.12) on the new architecture
    • Adds support for unauthenticated SMTP server configuration
    • Updates KOTS preflights to support TLS for Redis and PostgreSQL connections

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Requires the btree_gin PostgreSQL extension to be installed on the database before upgrading, or the upgrade will fail.
42. 2023.12.0 Dec 13, 2023 · release notes

    GitGuardian Self-Hosted 2023.12.0 adds Azure Repos real-time detection, IP allow-listing for honeytokens, Jira Cloud unassigned issue creation, and Helm private registry supp

    • Adds replicasets to the required Kubernetes RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. resources list for KOTS upgrades
    • Adds real-time monitoring capability for Azure Repos repositories
    • Adds IP allow-listing for Honeytokens via IP rules to prevent triggering events from specified ranges
    • Enables creation of Jira Cloud issues without assigning them to a user
    • Adds an onboarding todo list in the UI to guide new users through initial steps

    +6 more show less

    • Implements new filtered page filtering mechanism across the platform
    • Supports Kubernetes versions 1.27 and 1.28 (experimental) for Self-Hosted deployments
    • Introduces new pod Replicated SDK for license management and telemetry collection in Helm/KOTS installation
    • Adds support for specifying existing Docker secrets and custom registries in Helm Chart for private image pulls
    • Adds customization of pod security context configurations via Helm values (containerSecurityContext) aligned with Kubernetes v1.25 Pod Security Admission
    • Adds custom_telemetry_active setting in Admin preferences to enable/disable collection of VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures., incident counts, and API call statistics

    11 details in Everything

43. 2023.11.0 Nov 16, 2023 · release notes

    GitGuardian 2023.11 introduces team-level alerting API, Honeyton for self-hosted and Chainguard images

    • Adds experimental.chainguard Helm flag to enable reduced-CVE Chainguard-based images (default false)
    • New REST endpoint to retrieve secret incidents for a specific team via the API
    • Honeytoken module becomes available for Self-Hosted customers (upon request)

    3 details in Everything

44. 2023.10.0 Oct 23, 2023 · release notes

    GitGuardian Self-Hosted v2023.10.0 adds OpenShift support and upgrades secrets engine

    • Adds official OpenShift platform support for self-hosted deployment

    1 detail in Everything

45. 2023.9.0 Sep 21, 2023 · release notes

    GitGuardian 2023.9.0 adds four new secrets detectors and custom detector support for self-hosted users.

    • Upgrades the secrets detection engine to v2.96 adding Databricks Authentication Token With Hostname, Hashicorp Vault Token, Generic Terraform Variable Secret, and CARTO API Access Token detectors
    • Enables self-hosted users to create and manage custom detectors tailored to organizational secrets

    2 details in Everything

46. 2023.8.0 Aug 22, 2023 · release notes

    GitGuardian 2023.8.0 adds Azure AD and Pinecone detectors, incident filters, and exposes metrics on port 9808

    • Adds Azure Active Directory API Keys, Docusign API Key, and Pinecone API Key detections in secrets detection engine v2.94
    • Adds the Default branch tag to secret incidents occurring on a repository's default git branch
    • Adds filters to the occurrences table in Incident details
    • Changes metrics exposure port from 8082 to 9808 for applicative metrics

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Custom webhook v1 feature has been replaced by event-based custom webhooks and is deprecated.
47. 2023.7.0 Jul 17, 2023 · release notes

    Automated severity scoring, custom severity rules, and configurable PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. lifetime in GitGuardian Self-Hosted

    • Adds automated severity scoring for incidents in Self-Hosted environments
    • Introduces customizable severity ruleset for automated scoring to improve coverage
    • Enables managers to enforce a maximum lifetime for personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. via the API
    • Upgrades secrets detection engine to version 2.93, adding detectors for Tableau Personal Access Token, Yelp API Key, AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure. Keys, and Forest Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. Key

    4 details in Everything

48. 2023.05.0 May 15, 2023 · release notes

    Secret detectors exposed via API and new detection capabilities in v2.89

    └──▷ HOW TO FIND IT
    Search for incidents specifically involving a sensitive configuration file like .env.
    📍# Navigate to Incidents in UI, type filepath:.env into the free-text search bar
    Create a new incident note linking an investigation finding.
    copy

    $ curl -X POST https://<instance>/api/v1/incidents/<id>/notes \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json' \
      -d '{"comment": "Investigation complete. False positive confirmed."}'

    • GET /api/v1/detectors (or equivalent detectors endpoint) now exposes available secret detector definitions, allowing external tooling to programmatically enumerate supported secret types.
    • Free-text search field in the secret incidents table now supports filtering by filepaths, enabling precise incident discovery without navigating nested lists.
    • Secrets detection engine upgraded to v2.89, adding seven new detector rules: Azure Cosmos DB Credentials, Redis Server Password, DigitalOcean Refresh Token, DigitalOcean OAuth Application Token, DigitalOcean Personal Access Token, Cloudinary API keys, and MongoDB Atlas Keys.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The comment field is now required when creating an incident note via the API.
49. 2023.04.0 Apr 17, 2023 · release notes

    GitGuardian Self-Hosted 2023.04.0 adds Keycloak API key detection, customizable remediation workflows, and new API token management endpoints

    • Upgrade secrets detection engine to version 2.87 with a new detector for Keycloak API Keys
    • Remediation workflow is now 100% customizable thanks to the deletion of the last static step
    • API: new endpoints are added for API tokens management (personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. and service accounts)
    • API: new fields resolver_id and ignorer_id are available in the secret incident payload

    4 details in Everything

50. 2023.03.0 Mar 13, 2023 · release notes

    GitGuardian Self-Hosted 2023.03 adds Azure Repos loader/notifications and API filters.

    • Adds Azure Repos integration with a dedicated loader and notifications during organization installation
    • Adds filter capabilities to multiple API endpoints

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Embedded clusters now require PostgreSQL 13; users on older versions must migrate using the documented procedure
51. 2023.02.0 Feb 13, 2023 · release notes

    GitGuardian Self-Hosted 2023.02.0 adds Azure Repos integration and custom remediation workflows.

    └──▷ HOW TO FIND IT
    Scan repositories hosted on Azure DevOps for secrets.
    📍Steps: In the UI, go to Integrations › Repositories and enable Azure Repos.
    Configure how detected secrets are handled via the custom workflow engine.
    📍Steps: Navigate to Settings › Remediation Workflow and define your custom logic.
    • Azure Repos native integration for secret detection and policy breaks
    • Custom remediation workflow configurable in settings

    2 details in Everything

52. 2023.01.0 Jan 16, 2023 · release notes

    GitGuardian Self-Hosted 2023.01.0 adds Auto-resolution playbooks and team description fields

    └──▷ HOW TO FIND IT
    Create an auto-resolution playbook via the UI to handle stale valid secrets automatically
    📍Navigate to Playbooks › New Playbook, select Auto-resolution as the type, and configure the target perimeter.
    • Adds Auto-resolution playbook type to automatically close incidents that were once valid but are now invalid
    • Adds a description field for Teams in the UI
    • Makes the all-incidents team visible in the Members table

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for PostgreSQL version 12 is deprecated; environments should plan migration to supported version 13
53. 2022.12.0 Dec 12, 2022 · release notes

    GitGuardian Self-Hosted 2022.12.0 increases historical scan size limit and adds external_id to API payloads

    • Increases the maximum size of historical scans from 1 GB to 12 GB.
    • Adds external_id field to API source payload representing the VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. id.

    2 details in Everything

54. 2022.11.3 Nov 30, 2022 · release notes

    GitGuardian Self-Hosted 2022.11.3 allows configuring Kubernetes pod memory limits via Admin Console

    • Integrates memory limits for Kubernetes pods with configuration support on the Admin Console

    1 detail in Everything

55. 2022.11.2 Nov 21, 2022 · release notes

    New team management with granular permissions, stabilized custom CA support, and enhanced webhook/analytics capabilities

    • Adds Teams feature within a workspace for user management and granular incident permissions (can view, can edit, full access)
    • Updates Custom webhooks action field to accept more user-friendly messages

    2 details in Everything

56. 2022.09.0 Sep 5, 2022 · release notes

    GitGuardian Self-Hosted 2022.09 adds API filters for members/audit logs, custom pod CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. limits, and bulk action counts.

    • API: add a filter by role and a search on name and email for the /members endpoint.
    • API: add filters to the audit log list endpoint.
    • Cluster Management: add a parameter to customize pods' CPU limits.
    • Features API: enrich the Members section with retrieve and delete endpoints.
    • API: handle invitations on grant/revoke access endpoints.

    +1 more show less

    • Incidents: include the unaffected count for bulk actions.

    6 details in Everything

57. 2022.08.0 Aug 8, 2022 · release notes

    New audit logs API endpoint, /occurrences filtering, and tags in incidents/CSV reports.

    └──▷ TRY IT
    Fetch audit logs using the new dedicated endpoint with the required scope.
    copy

    $ curl -H 'Authorization: Bearer <TOKEN>' https://<host>/api/audit_logs

    Filter secret occurrences by the author who introduced them.
    copy

    $ curl -G 'https://<host>/api/v1/occurrences?author_name=alice' --header 'Authorization: Bearer <TOKEN>'

    • Adds /audit_logs API endpoint to fetch audit logs (requires audit_logs:read scope)
    • Allows filtering the /occurrences endpoint by author_name and author_info query parameters
    • Exposes tags in the incidents API response and CSV secret incident reports
    • Adds applicative metrics for scanned commit, API quota, API usage, and API tokens

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !issue_id is renamed to incident_id on incident note management endpoints
58. 2022.07.0 Jul 11, 2022 · release notes

    New ggshield auth command, invitation management API endpoints, CSV export columns, and severity setting endpoint

    └──▷ TRY IT
    Authenticate ggshield interactively to prepare it for scanning repositories.
    copy

    $ ggshield auth login

    • Adds the ggshield auth login subcommand to simplify initial setup of ggshield.
    • Adds /members/invitations API endpoints (requiring members: write scope) to manage user invitations programmatically.
    • Adds status, ignore_reason, and status_revoked columns to the CSV export of secret incidents.
    • Adds occurrence_id column to the CSV export of occurrences.
    • Adds a new API endpoint to set the severity of a secret incident.

    5 details in Everything

59. 2022.04.1 Apr 22, 2022 · release notes

    GitGuardian 2022.04.1 adds GitHub check run regression mode, PR comment posting, incident member API, and database secret encryption.

    └──▷ HOW TO FIND IT
    Disable PR timeline comments for secret detections in the Settings UI.
    📍In the Admin Area › GitHub Settings, toggle Post comment to PR timeline to OFF
    • Adds regression_mode support for GitHub Check Runs so already-resolved secrets are no longer re-raised when the flag is OFF
    • Enables posting a comment directly to the GitHub Pull Request timeline when a check run detects a secret, controllable via Manager Settings
    • Introduces an API endpoint to list members who have access to a specific incident
    • Enables encryption of secrets stored in the PostgreSQL database

    4 details in Everything

60. 1.35 Mar 25, 2022 · release notes

    GitGuardian Self-Hosted 1.35 adds PostgreSQL TLS support and exposes Members in API with new fields

    • TLS is now supported for PostgreSQL connections during installation to encrypt data in transit

    1 detail in Everything

61. 1.34 Feb 11, 2022 · release notes

    GitGuardian Self-Hosted 1.34 adds TLS support for Redis connections

    • Adds TLS Support for Redis configuration option to encrypt data in transit.

    1 detail in Everything

62. 1.32 Dec 14, 2021 · release notes

    Incident sharing scope, configurable GG behavior for recurring incidents, and validity fields in webhook/scan payloads.

    • Adds the incident::share scope to the Features API to grant access to incidents
    • Adds a workspace setting to control GitGuardian's behavior when a new occurrence of an already-resolved incident is detected
    • Adds validity and severity fields to custom webhook payloads
    • Adds validity field to scan result responses

    4 details in Everything

63. 1.31 Nov 15, 2021 · release notes

    GitGuardian Self-Hosted v1.31 adds dashboard-driven secret ignore lists and detector activation state to ggshield

    • Adds ggshield synchronization with the dashboard for secrets ignored on the dashboard
    • Adds ggshield synchronization with the dashboard for deactivated detectors

    2 details in Everything