https://cybertoolchain.io/tools/gitguardian-self-hosted New releases and features in GitGuardian Self-Hosted, tracked by The Cyber Toolchain. en Fri, 23 Oct 2026 11:17:52 GMT https://docs.gitguardian.com/releases/self-hosted https://docs.gitguardian.com/releases/self-hosted Fri, 23 Oct 2026 11:17:52 GMT GitGuardian Self-Hosted 2026.10 adds Wiz integration, source-status filtering, AI Hook expansion, and 19+ new secret detectors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Wiz integration that syncs active secret incidents from version control sources to Wiz daily as native secret findings, with detection context and a link back to GitGuardian (never the secret value); requires outbound HTTPS access to your Wiz tenant.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds source-status visibility — every source now shows `Monitored`, `Unmonitored`, `Unreachable`, `Archived`, or `Deleted` state — and lets you filter on that status from the perimeter page and incident list, and save it as a named view. • Adds automatic pause-and-resume for unreachable integrations (GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Confluence, Slack, and Microsoft Teams on Self-Hosted): real-time ingestion and historical scans pause when a token expires or a provider is unreachable, and resume automatically once reconnected. • Adds `is all of` operator to the source-status filter. • Adds `beat.metricsPort` config key so the task scheduler exposes Prometheus metrics, and the chart creates a ServiceMonitor for it when ServiceMonitors are enabled. • Adds public API endpoint to trigger a presence check. • Adds public API endpoints to find the GitHub check runs that reported an incident and to skip a blocking check run, enabling custom approval flows to unblock a pull request. • Adds author attribution for custom sources and coverage of Public Monitoring secrets (secret value and validity) to the public API. • Expands AI Hooks coverage to Amazon Kiro and Junie CLI (joining Claude Code, Codex, and Mistral Vibe); tool output containing a secret is withheld from the assistant; requires ggshield 1.55.0 or later. • Supports Kubernetes 1.36; the Helm chart ships ggscout 0.33.0, which collects Azure Key Vault secret tags, GitLab CI environment scopes, and Akeyless item tags for per-secret environment classification in NHI Governance. Breaking changes: • Legacy analytics are removed in 2026.10: if in-app analytics are disabled on your instance, you must enable them before upgrading or your analytics dashboards will be lost. • Background migrations must complete before an upgrade is accepted; attempting to upgrade while they run is refused with 'Not all required migrations have been applied' — wait for them to finish, then retry. • Embedded cluster preflight checks now require at least 12 CPU cores and 48 GiB of memory (up from 8 cores and 30 GiB); a smaller VM fails the check on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2026-10-changelog https://docs.gitguardian.com/releases/self-hosted/2026-10-changelog Tue, 20 Oct 2026 00:00:00 GMT GitGuardian Self-Hosted 2026.10 adds Wiz integration, source-status filtering, AI Hook coverage for Kiro/Junie, and richer vault metadata via ggscout 0.33.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `beat.metricsPort` Helm value to configure the port on which the task scheduler exposes Prometheus metrics, with automatic `ServiceMonitor` creation when ServiceMonitors are enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Wiz integration that syncs active secret incidents from version control sources to Wiz daily as native secret findings, including detection context and a link back to GitGuardian but never the secret value — requires outbound HTTPS to your Wiz tenant. • Adds source-status visibility: every source now displays one of `Monitored`, `Unmonitored`, `Unreachable`, `Archived`, or `Deleted` states, filterable from the perimeter page and incident list, with an `is all of` operator, and saveable as a named view. • Adds public API endpoints to trigger a presence check on a secret, to find the GitHub check runs that reported an incident, and to skip a blocking check run, enabling custom approval flows to unblock pull requests. • Adds author attribution for custom sources and coverage of Public Monitoring secrets to the `secret value` and `validity` public API endpoints. • Adds configurable API timeout for `ggshield` via the API timeout setting. • Adds two new team perimeter settings to either keep unmonitored sources in teams or remove archived ones. • Adds audit log CSV exports that detail which secrets were exported. • Adds AI Hook coverage for Amazon Kiro and Junie CLI, withholding tool output containing secrets from the assistant model — requires `ggshield` 1.55.0 or later. • Adds `ggscout` 0.33.0 support, collecting Azure Key Vault secret tags, GitLab CI environment scopes, and Akeyless item tags for per-secret environment classification used in the exploration map, cross-environment secrets policy, and risk criticality. Breaking changes: • Legacy analytics are removed on upgrade to 2026.10; if in-app analytics are disabled on your instance you must re-enable them before upgrading or your analytics dashboards will be lost. • Embedded cluster preflight checks now require at least 12 CPU cores and 48 GiB of memory (up from 8 cores and 30 GiB); a smaller VM will fail the check. • An upgrade to 2026.10 is refused with 'Not all required migrations have been applied' if background migrations from a prior release are still running; certain migrations must also complete on 2026.10 before upgrading to 2026.11. • This is a required release and cannot be skipped. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted https://docs.gitguardian.com/releases/self-hosted Mon, 05 Oct 2026 07:56:28 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted https://docs.gitguardian.com/releases/self-hosted Sun, 04 Oct 2026 07:49:54 GMT GitGuardian Self-Hosted adds honeytoken-based AWS credential decoy planting for endpoint credential-harvesting detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Plants a decoy AWS credential in the file credential-harvesting malware reads first, triggering an alert that names the compromised endpoint when the honeytoken is used.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a coverage card to the Endpoints dashboard showing the share of your fleet protected by the decoy credential feature. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted https://docs.gitguardian.com/releases/self-hosted Sat, 26 Sep 2026 12:46:10 GMT GitGuardian Self-Hosted: Adds per-team incident permissions when promoting a user to Member, and extends linked Jira ticket comments to cover reassignment, regression, validity, access grants and revocations, public sharing, and feedback events. Breaking changes: • The automatic Personal Access Token renewal system for Jira Data Center and Confluence Data Center integrations is removed. Before upgrading, manually update the token for every Jira Data Center and Confluence Data Center integration (sources and notifiers) with a long-lived PAT via the integration settings. An integration still relying on renewal will stop working when its token expires. • ClickHouse is now rendered under `clickhouse.*` in the GitGuardian chart instead of the vendored `clickhouse-server` subchart. Any `clickhouse-server.*` values from 2026.8 must be moved to `clickhouse.*` before upgrading; the chart refuses to render while a `clickhouse-server` block is present. Object storage and backup settings move to `clickhouse.objectStorage` and `clickhouse.backup`, and `clickhouse.serverConfig` keys switch to camelCase. • Argo CD installations that do not use an outbound proxy will see `1 resources require pruning` and stay `OutOfSync` after upgrade, because the chart no longer creates the `gim-proxy` and `gim-migration-proxy` Secrets when no proxy URL is set. Resolve by running `argocd app sync <app> --prune` or enabling automated pruning. • ggscout outside the cluster must be upgraded to 0.32.0 or later; earlier versions do not classify collected secrets with the Secrets Detection Engine. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2026-09-changelog https://docs.gitguardian.com/releases/self-hosted/2026-09-changelog Fri, 25 Sep 2026 00:00:00 GMT GitGuardian Self-Hosted 2026.9 adds Bridge networking, honeytoken endpoint protection, AI hooks for Codex and Mistral Vibe, and vaulted-secret classification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `GGBridge.bridges` Helm values key to declare GitGuardian Bridge servers, enabling scanning of sources in isolated networks (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ a GitLab instance behind a firewall) without opening inbound connections. • Adds `inAppAnalytics.postgresql.applicationSchema`, `useSeparateAnalyticsSchema`, and `analyticsSchema` Helm/config keys so in-app analytics can write to custom PostgreSQL schemas instead of `public`. • Adds `replicated.supportBundle.nodeSelector`, `tolerations`, and `affinity` Helm keys to schedule the support bundle pod on specific or tainted nodes. • Adds `mcpServer.oauth.extraRedirectUris` Helm key to register a custom MCP gateway as an OAuth callback. • Adds `clickhouse.objectStorage` and `clickhouse.backup` Helm keys (replacing `clickhouse-server.*` subchart values) as structured storage config under the new first-party `clickhouse.*` key. • Adds honeytoken protection for endpoints: `ggshield` plants a decoy AWS credential in credential-harvesting malware read paths, with fleet coverage tracked in the Endpoints dashboard (requires Endpoint Protection and ClickHouse). • Extends AI Hooks to block secrets inside Codex and Mistral Vibe, alongside existing Claude Code, Cursor, Copilot CLI, and VS Code support; adds a new inventory of AI agents and MCP servers per endpoint (requires `ggshield` 1.54.0+). • Adds vaulted-secret classification: `ggscout` now runs the Secrets Detection Engine on every collected value, enabling NHI inventory filtering by detector, detector type, secret family, category, and provider (requires `ggscout` 0.32.0+). • Adds ClickHouse health coverage to the Admin Area Health check page, admin banner, and notification emails, including HTTP reachability, metadata volume fill level against a configurable threshold, and backup freshness from the backup sidecar. • Adds Prometheus metrics with recommended thresholds and alerts for ClickHouse and the backup sidecar, and includes their logs and collectors in the support bundle. • Adds a configurable validity-check mode that omits a detector's default public host and checks secrets only against custom hosts, supporting air-gapped networks. • GitHub app installations made outside the dashboard (e.g. from the app's public GitHub page) now queue for Owner or Manager approval on the GitHub / GitHub Enterprise Server settings page instead of joining the monitored perimeter automatically. • Adds 6 new detectors in Secrets Detection Engine v2.170: Firebase ID Token, Coze Access Token, Keycloak Access Token, Keycloak Refresh Token, Fish Audio API Key, and Azure Custom Vision Training Key. • Adds 2 new analyzers in Secrets Detection Engine v2.171: Akamai API Credentials and Docker Credentials. • Adds 1 new analyzer in Secrets Detection Engine v2.170: Apify Token. Breaking changes: • Jira Data Center and Confluence Data Center: the automatic PAT renewal system is removed. Every Jira Data Center and Confluence Data Center integration (sources and notifiers) must be updated with a long-lived PAT in the integration settings before upgrading, or the integration will stop working when its current token expires. • ClickHouse (Helm installations): `clickhouse-server.*` subchart values are replaced by `clickhouse.*`. Any `clickhouse-server.*` block must be migrated to `clickhouse.*` before upgrading — the chart refuses to render while a `clickhouse-server` block is present. Object storage and backup settings move to `clickhouse.objectStorage` and `clickhouse.backup`; `clickhouse.serverConfig` keys switch to camelCase. • Argo CD installations: proxy Secrets `gim-proxy` and `gim-migration-proxy` are no longer created when no proxy URL is set, leaving the previously created Secrets behind. The sync ends with '1 resources require pruning' and the application stays OutOfSync until you prune (e.g. `argocd app sync <app> --prune`). • `ggscout` minimum version moves to 0.32.0; earlier versions will not classify collected secrets with the Secrets Detection Engine. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted https://docs.gitguardian.com/releases/self-hosted Tue, 08 Sep 2026 07:45:11 GMT Self-hosted gains real-time validity check processing and AWS IAM identity linking for secrets stored in vaults and Kubernetes. • Validity check results and incident creation events are now processed immediately on self-hosted instead of queuing. • AWS access keys stored in a secrets manager, Vault, or Kubernetes are now linked to their AWS IAM identity in the NHI Governance identity map. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted https://docs.gitguardian.com/releases/self-hosted Mon, 31 Aug 2026 07:40:55 GMT GitGuardian Self-Hosted 2026.8.0 adds ClickHouse analytics, an MCP server, custom validity via API, AI-powered incident search, and 25+ new secret detectors. • Adds `clickhouse-backup` sidecar and ClickHouse as an optional in-cluster column-oriented database (StatefulSet backed by S3-compatible object storage) deployable via Helm or KOTS, powering Endpoint Protection analytics; becomes mandatory in 2027.1.0. • Adds a GitGuardian Remote MCP server deployment (Helm only, beta, disabled by default) that runs in-cluster so no traffic or secrets leave the network — point Claude, Cursor, or any MCP client at the instance to scan for leaked credentials, manage incidents, and deploy honeytokens from the IDE. • Adds a 'Set your own validity status' API call that accepts `valid` or `invalid` for secrets on internal systems GitGuardian cannot reach; incidents display `Custom validity` with the date set, recorded in the incident activity log and audit log. • Enables the unified filter bar on self-hosted, supporting incident search by secret value, commit author, or file path; Plain-English search (AI Filters) activates once a workspace administrator enables the External LLM toggle under `Settings > Workspace > AI`. • Adds Personal Access Token and Service Account Token creation through the public API for automated rotation workflows. • Adds the `Only use detectors with validators` option as settable on custom sources through the public API. • Adds a new Azure DevOps extension that inserts a `ggshield` scan job into every pipeline in an organization via a single pipeline decorator. • Adds a dedicated GitHub check runs page in the Perimeter section showing status, repository, commit, and linked pull request, with in-dashboard re-run or skip actions. • Adds `@`-mention support for members and teams in incident notes and feedback, triggering email notifications on both Internal and Public Monitoring incidents. • Adds automatic monitoring and automatic scan toggles for Jira Cloud, Jira Data Center, Confluence Cloud, Confluence Data Center, and Microsoft Teams sources. • Adds tunable `emptyDir` volume limits for the `ml-secret-engine` pod in the Helm chart. • Scans triggered via a Personal Access Token now emit an audit log event. • Adds 11 new detectors in v2.167: Azure SQL Credentials, Azure Machine Learning Key, Azure Video Indexer Key, Azure Health Insights Key, Azure Fluid Relay Key, LiteLLM API Key, DashScope API Key, Apify Proxy Token, Authress Access Key, and two Gemfury token variants. • Adds 6 new or upgraded checkers in v2.167: LiteLLM Without Host, LaunchDarkly SDK Key, Llama Cloud API Key, New Relic APM License Key, npm Token, Hume AI API Key. • Adds 4 new detectors in v2.168: Azure Immersive Reader Key, DashScope Coding Plan API Key, DashScope Token Plan API Key, Prefect Cloud API Key. • Adds 2 new checkers in v2.168: Alibaba Cloud IAM, GitLab Deploy Token. • Extends HTML/Markdown scanning in v2.168 to npm, GitHub Personal Access, GitHub OAuth, GitHub App, and Slack Application tokens. • Adds 7 new detectors in v2.169: Slack Webhook Trigger URL, n8n API Key, Atlassian Auth Key, AWS Cognito Access Token, OpenAI Access Token, Vercel OIDC Token, OpenCode API Key. • Adds 1 new checker in v2.169: Supabase Service Role JWT. • Adds 2 new detectors in v2.169.1: Lovable Access Token, Lovable Git Token. • Adds fine-grained GitHub personal access token support for private members monitoring in the Public Monitoring perimeter. Breaking changes: • The `Display as Tree` view is removed from integration source pages. • ClickHouse is optional in 2026.8 but becomes mandatory in 2027.1.0, requiring object storage (S3-compatible; Azure Blob Storage and GCS in progress) to be provisioned before upgrading to that release. • The Grafbase Access Token detector is removed and the Amadeus OAuth Credentials detector is disabled, as both services were discontinued. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted https://docs.gitguardian.com/releases/self-hosted Fri, 31 Jul 2026 16:20:25 GMT GitGuardian Self-Hosted 2026.7 adds Public Monitoring, native Gerrit scanning, Smart Notifiers, MCP server, and 9 new secret detectors. • Adds Public Monitoring on self-hosted instances (license-gated): monitor your public perimeter for secret leaks and route public incidents through webhooks, Slack, Microsoft Teams, ServiceNow, and email alerts filterable by public incident severity. • Adds native Gerrit VCS source with full historical scanning, real-time detection via the webhook plugin, and read-replica support for cloning. • Introduces Smart Notifiers: define per-channel rules to filter alerts, tickets, or emails by severity, validity, secret type, or GitGuardian tag across internal and public monitoring. • GitHub check runs now scan oversized pull requests by cloning the repository branch instead of calling the GitHub API commit-by-commit, with configurable size thresholds and the ability to skip merge commits to protect shared API rate limits. • Supports routing external traffic through the Kubernetes Gateway API instead of the legacy Ingress resource, with Kubernetes HPA or KEDA autoscaling for webapps. • Adds 9 new secret detectors (Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, and five Azure services: Maps, Mixed Reality, Service Bus, Quantum, Bot Direct Line) and 2 new checkers (Gemfury Deploy/Push Token, Gemfury Full Access Token). • Jira Notifier now exposes remediation guidance and detector-specific links as assignable fields in the ticket description template. • Adds a Custom Sources (BYOS) option to scan with validated detectors only. • Adds a new opt-in `mcpServer` Helm deployment to run the GitGuardian MCP server in your cluster (currently in beta). • The daily analytics job can now write Spark scratch data to a dedicated ephemeral volume instead of the node's local disk, preventing failures from ephemeral-storage limits on large workspaces. • Incident assignment now auto-grants access to the assignee. • `logCollector.collectMigrationLogs` is now enabled by default, injecting a native sidecar to collect logs from pre-deploy and post-deploy hook Jobs (requires Kubernetes 1.29 or later). Breaking changes: • `logCollector.collectMigrationLogs` is enabled by default and requires Kubernetes 1.29 or later; clusters running older Kubernetes versions will break unless `logCollector.collectMigrationLogs: false` is set before upgrading. • Developer Endpoint Protection is not functional on self-hosted instances in this release; installations relying on Endpoint Protection will lose that capability on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2026-07-changelog https://docs.gitguardian.com/releases/self-hosted/2026-07-changelog Fri, 24 Jul 2026 00:00:00 GMT GitGuardian Self-Hosted 2026.7 adds Public Monitoring, native Gerrit scanning, Smart Notifiers, Gateway API routing, and 9 new secret detectors. • Adds Public Monitoring on self-hosted instances (license-gated): monitor your public perimeter for secret leaks and route public incidents through custom webhooks, Slack, Microsoft Teams, ServiceNow ticketing, and severity-filtered email alerts via the new `celeryWorkers.public-monitoring` worker. • Adds native Gerrit VCS source with full historical scanning, real-time detection via webhook plugin, and read-replica support for cloning. • Adds Smart Notifiers: define per-channel rules to filter alerts, tickets, and emails by severity, validity, secret type, or GitGuardian tag across internal and public monitoring. • GitHub check runs now scan oversized pull requests by cloning the repository branch instead of calling the GitHub API commit-by-commit, and can skip merge commits to protect shared API rate limits; thresholds and behavior are configurable from the admin area GitHub preferences. • Adds Gateway API routing to direct external traffic through the Kubernetes Gateway API instead of the legacy Ingress resource, plus support for HPA or KEDA autoscaling for webapps. • Secrets Detection Engine v2.166 adds 9 new detectors: Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, and five Azure services (Maps, Mixed Reality, Service Bus, Quantum, Bot Direct Line), plus 2 new checkers (Gemfury Deploy/Push Token, Gemfury Full Access Token). • Jira Notifier now exposes remediation guidance and detector-specific links as assignable fields in the ticket description template. • Custom Sources (BYOS) gain an option to scan with validated detectors only. • The daily analytics job can now write Spark scratch data to a dedicated ephemeral volume instead of the node's local disk, preventing failures on large workspaces. • Adds opt-in `mcpServer` deployment (Helm only, beta) to run the GitGuardian MCP server in-cluster; disabled by default. Breaking changes: • Helm installations: `logCollector.collectMigrationLogs` is now enabled by default and injects a native sidecar requiring Kubernetes 1.29 or later; on older clusters you must set `logCollector.collectMigrationLogs: false`. • Endpoint Protection (Developer Endpoint Protection) is not functional on self-hosted instances in this release — do not upgrade if you rely on Endpoints without contacting GitGuardian support first. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2026-06-changelog https://docs.gitguardian.com/releases/self-hosted/2026-06-changelog Fri, 19 Jun 2026 00:00:00 GMT GitGuardian Self-Hosted 2026.6 adds 20+ new secret detectors, a premium scan retry worker, Teams granular alerting, and open-source AI agent skills. • New premium scan retry worker (Helm only): routes failed large-repo VCS scans to a dedicated high-memory, scale-to-zero pod, keeping base scanner pods small. • New open-source agent-skills repository (GitGuardian/agent-skills) teaches AI coding assistants (Claude Code, Cursor) when to scan, how to read findings, and how to guide developers through remediation. • Secrets Detection Engine v2.163 adds 6 new detectors: Aikido API OAuth2 Credentials, Logflare Access Token, PolyAPI API Key, Apollo.io API Key, AES Cipher Key, and SAP OAuth Credentials. • Secrets Detection Engine v2.164 adds 6 new detectors: Authentik API Token, Pagar.me Encryption Key, Adobe Refresh Token, LiteLLM API Key, brapi.dev API Key, and Open VSX Access Token, plus a new Google OAuth2 Keys checker and Adafruit IO API Key analyzer. • Secrets Detection Engine v2.165 adds 8 new detectors (Stitch API Key, ActiveMQ Credentials, Instantly API Key, Gitea Access Token, Fal.ai API Key, SurrealDB Cloud JWT Token, Kimi API Key, Wiz OAuth Credentials) and 8 new checkers including Okta, Azure, AWS Cognito, LaunchDarkly, Pulumi, and PyPI. • Microsoft Teams granular alerting: subscribe individual channels to specific incident event types for fine-grained notification control. • Jira Cloud integration switches from webhooks to recurrent scanning; VCS historical scans now cover orphaned commits, Git notes, and pull/merge request refs. • Overview analytics now include Non-Human Identities (NHI); GitHub check runs can skip merge commits; Jira/ServiceNow tickets can be dissociated from incidents; GitLab read-only group hook tokens supported. • Updated system requirements: Kubernetes 1.30+ (1.35 recommended), PostgreSQL 15+ (17 recommended), Redis 6+ (7 recommended), ggscout 0.19.0+, KOTS 1.117.3+. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2026-06-changelog https://docs.gitguardian.com/releases/self-hosted/2026-06-changelog Fri, 19 Jun 2026 00:00:00 GMT GitGuardian Self-Hosted 2026.6 adds premium scan retry worker, agent skills, 19 new detectors, and granular Teams alerting. • Adds `Premium scan retry worker` (Helm-only optional deployment) to route large, OOM-prone VCS scans to a dedicated high-memory pod, keeping base workers small. • Ships open-source `GitGuardian/agent-skills` repository to teach AI coding assistants how to scan, read findings, and remediate secrets via ggshield. • Introduces 19 new secret detectors across engine versions v2.163–v2.165, including Aikido API OAuth2 Credentials, Authentik API Token, Stitch API Key, and others. • Adds granular Microsoft Teams alerting for internal monitoring, allowing subscription to specific incident event types per channel. • Enables Jira Cloud recurrent scanning (replacing webhooks) and extends VCS historical scans to cover orphaned commits, Git notes, and pull/merge request refs. Breaking changes: • Updates minimum system requirements for Self-Hosted deployment: KOTS 1.117.3+, Kubernetes 1.30+, PostgreSQL 15+, Redis 6+; Helm values require review for compatibility. • The `sap_ai_core_credentials` detector is replaced by the new `SAP OAuth Credentials` checker in engine v2.165. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2026-05-changelog https://docs.gitguardian.com/releases/self-hosted/2026-05-changelog Thu, 21 May 2026 00:00:00 GMT GitGuardian 2026.5 adds advanced analytics dashboard, NHI governance flags, AI workspace settings, Atlassian attachment scanning, Slack capabilities, and Secrets Detection En • Enables Advanced Analytics by default on Helm installations with the new Analytics Overview page aggregating Protect, Detect, Remediate, and Govern KPIs • Adds AI workspace setting for self-service enable/disable of external LLM calls and BYOC provider configuration (AWS Bedrock) at `Settings → Workspace → AI` • Introduces NHI admin and overprivileged flags in NHI Governance to flag non-human identities across AWS IAM, Microsoft Entra, and Okta with automatic severity bumping for admin breaches • Extends attachment scanning to Jira Cloud, Jira Data Center, Confluence Cloud, and Confluence Data Center (requires reinstall of Atlassian integrations for new scopes) • Adds Slack file attachment scanning, interactive thread responses (beta), and private channel name redaction by updating Bot Token Scopes in the existing Slack app • Upgrades Secrets Detection Engine to v2.161 with 7 new detectors, 1 checker, and 5 analyzers for credentials like Payhere, HubSpot, Datadog, and GitGuardian tokens • Upgrades Secrets Detection Engine to v2.162 with 16 new detectors, 6 detector updates, and 3 analyzer updates covering Aikido, Baidu, Bitrise, Canva, Cloudflare, and other keys Breaking changes: • Deprecated Honeytoken Labels Public API has been removed (use Custom Tags) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2026-04-changelog https://docs.gitguardian.com/releases/self-hosted/2026-04-changelog Wed, 22 Apr 2026 00:00:00 GMT Email verification MFA, ggshield real-time AI coding tool scanning, and in-cluster support bundle generation • Adds `email`-based MFA requiring verification codes at login and before sensitive workspace actions for email/password users • Adds `ggshield` real-time scanning of prompts, tool calls, and agent actions for Cursor, Claude Code, and GitHub Copilot • Adds Team perimeter scoping for non-VCS sources (container registries, messaging, docs, tickets, package registries) via Incident visibility settings • Adds in-cluster support bundle generation from Admin area > Support Bundle page, eliminating `kubectl` or Krew plugin requirements • Adds 16 new detectors/checkers including Polar Organization Access Token, Microsoft Azure Storage Account Key, and DeepL keys to detection engine v2.159 • Adds 5 new checkers for Kubernetes Docker Secrets and Private Keys with GitLab/GitHub registration checks in detection engine v2.160 • Brings `location.url` field support and v2 format tokens for Personal/Service Accounts to Bring Your Own Sources • Sets Critical saved view as default and adds severity rule ID/detector category fields to incidents • Adds `/v1/severity-rules` endpoint and historical scan trigger/cancel endpoints to public API • Adds workspace-level privacy mode enforcement and exposes audit log event types via public API • Adds namespace-scoped NetworkPolicy support configurable via `networkPolicy.*` Helm values with dryrun → enforce rollout • Makes manual encryption secret creation required for new Helm installations • Bundles JSON schemas into the deployment package for air-gapped environments • Adds `replicated.readOnlyMode` to prevent Replicated subchart from creating/patching Secrets Breaking changes: • Removes built-in support for `externalSecrets` in Helm installations; users must switch to `existingSecrets` and manage ExternalSecret resources manually Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2026-03-changelog https://docs.gitguardian.com/releases/self-hosted/2026-03-changelog Mon, 16 Mar 2026 00:00:00 GMT GitGuardian 2026.3 adds JFrog/Quay integrations, ~30 new detectors, and a public API for egress IPs. • Adds support for scanning JFrog Artifactory package registries (Maven, npm, PyPI, NuGet, Go, and more) with historical and incremental scanning. • Adds Red Hat Quay integration for detecting secrets in container images across quay.io and self-hosted deployments, with full image layer analysis and OAuth2 authentication. • Adds the Okta Integration Network integration for one-click SAML SSO, SCIM provisioning, and Group Push. • Adds 30 new secret detectors (v2.157/v2.158) including WooCommerce, Iyzico, Mercado Pago, Bitbucket HTTP Access Token, PostgreSQL, MariaDB, Azure Event Hub, Azure Container Registry, Coralogix, Azure Web PubSub, Azure Batch, Azure APIM Gateway, Azure IoT Provisioning, Azure AI Search, GitLab CI/CD Job Token, PostHog, MiniMax, Retell, Azure Storage Account Key, Curl Username Password. • Adds 4 new revokers for SendGrid, Slack User Token, Slackbot, and Heroku. • Adds a public API endpoint for retrieving GitGuardian egress IP addresses. • Adds customizable session duration for dashboard sessions. • Adds the ability for workspace managers to restrict Personal Access Token scopes for members. • Adds filename and line number fields to Jira templates. Breaking changes: • Embedded cluster installations running 2026.2.0 must manually delete the replicated PodDisruptionBudget before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2026-02-changelog https://docs.gitguardian.com/releases/self-hosted/2026-02-changelog Mon, 23 Feb 2026 00:00:00 GMT GitGuardian 2026.2 adds Dark Mode UI, new detectors via Secrets Engine v2.156, and optional worker-check-runs • `Dark Mode` interface added under Account → Interface → Theme for cleaner layouts and improved contrast. • Secrets Detection Engine `v2.156` adds coverage for Modelscope, Proxmox, ZegoCloud, Deepgram, Microsoft Power Apps Webhook, Mem0, and Obsidian detectors. • `worker-check-runs` optional worker introduced to offload `check_run` processing from `worker-worker`, enabled via Helm config. Breaking changes: • Kubernetes minimum version raised to 1.30 (EOL); upgrade to 1.35 recommended for stability. • Argo CD deployments now require a pre-created encryption secret before installing or upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2026-01-changelog https://docs.gitguardian.com/releases/self-hosted/2026-01-changelog Wed, 28 Jan 2026 00:00:00 GMT GitGuardian 2026.1 adds NHI integrations (Datadog, Snowflake, Okta, Auth0), GCP Marketplace deployment, enriched secret names, and Unified Identity Governance for Entra/AWS. • `Secret Enricher` now provides ML-powered generic incident details displaying enriched secret names • `More NHI Integrations` supports non-human identity discovery across Datadog, Snowflake, Okta, and Auth0 • `Unified Identity Governance` offers risk-based prioritization for Microsoft Entra ID and AWS IAM with secret-less OIDC authentication • Google Cloud Marketplace availability enables GitGuardian deployment on GKE with consolidated billing • Secrets Detection Engine v2.153 includes 6 new detectors (HighLevel, Elastic, Google Cloud Keys, Socket Dev, Upstash Redis, Vapid Key) • Secrets Detection Engine v2.154 adds 3 new detectors (Cloudflare R2, Azure SAS URL, MySQL) and 1 new checker (Tailscale SCIM) • Secrets Detection Engine v2.155 includes 18 new detectors including Oracle, Azure Entra App Secret, GitLab SCIM, and MongoDB • `Incident API` now returns enriched secret names in CSV/JSON exports • Detector settings include a "Recommended for business" filter to identify non-business detectors disabled by default Breaking changes: • KOTS Embedded installations must manually delete the PostgreSQL StatefulSet before upgrading to 2026.1 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-12-changelog https://docs.gitguardian.com/releases/self-hosted/2025-12-changelog Mon, 15 Dec 2025 00:00:00 GMT GitGuardian 2025.12 adds SCIM provisioning, CyberArk integration, in-app analytics beta, and multiple hostname support • Adds `extra_hostnames` Helm parameter to define additional domain names for self-hosted access • Adds SCIM team provisioning integration with Okta and Microsoft Entra ID • Adds CyberArk Secrets Manager Self Hosted integration for non-human identity enumeration • Enables advanced analytics dashboards for secret leak monitoring when enabled via `inAppAnalytics.enabled` Helm value or KOTS Admin Console toggle • Adds support for Helm v4 • Adds IPv6 support via the `network.ipFamily` parameter for Service resources • Adds global `podDisruptionBudget.enabled` Helm parameter to disable automatic PDB creation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-11-changelog https://docs.gitguardian.com/releases/self-hosted/2025-11-changelog Wed, 19 Nov 2025 00:00:00 GMT GitGuardian Self-Hosted 2025.11 updates secret detection, adds PostgreSQL 18 and Redis 8 support, and improves incident navigation. • Adds a new `Coveo API Key` detector to the secrets detection engine • Improves the `Resend` secret detector coverage • Adds one new secrets detection checker. • Upgrades an analyzer within the secrets detection engine • Includes a detection engine enhancement in version 2.150. • Adds source links to incident list entries and exposes `change_type` field in API responses • Shows Dev-in-the-Loop incident IDs and adds dashboard navigation for these incidents • Adds official support for PostgreSQL 18 as a supported database version • Adds official support for Redis 8 as a supported cache version • Enforces terms and conditions acceptance requirement during self-hosted instance setup • Simplifies Helm configuration by having Replicated inherit global image pull secrets, removing the need for separate `imagePullSecrets` in the `replicated` section Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-10-changelog https://docs.gitguardian.com/releases/self-hosted/2025-10-changelog Mon, 27 Oct 2025 00:00:00 GMT New Microsoft Teams attachment scanning, unified leak graph, and incident-based secret revocation in GitGuardian Self-Hosted 2025.10 • Adds `Microsoft Teams attachment scanning` to detect secrets in shared files within incidents. • Adds `unified graph with public leak intelligence` to correlate internal and public exposures. • Enables secret revocation directly from incidents via the new `Secret Revocation` workflow. • Adds `Context preview for non‑VCS incidents` to view surrounding content for leaks in SharePoint, OneDrive, and Confluence. • Adds `ggshield vault name and path` display to show secret manager details for vaulted secrets. • Updates Helm configuration to change the `log collector MinIO image` (see breaking changes). • Adds ARM64 cluster support for Helm deployments alongside existing AMD64 support. • Adds support for the read-only root filesystem constraint in container deployments. Breaking changes: • Upgrading to Helm installations changes the MinIO image used in the log collector; you must update your Helm values file. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-09-changelog https://docs.gitguardian.com/releases/self-hosted/2025-09-changelog Wed, 17 Sep 2025 00:00:00 GMT GitGuardian Self-Hosted 2025.9 adds BYO source scanning, AI filters, and SharePoint/OneDrive support • `Bring Your Own Sources` capability extends secret detection to CI logs, legacy systems, and SFTP • `Quick Access` unified search interface enabled via `Ctrl+K` / `Cmd+K` shortcut • `AI Filters` allows natural language filtering for incidents, perimeter, and audit logs • New `SharePoint` and `OneDrive` scanning integrations for knowledge base secret detection • New detectors in Secrets Detection Engine v2.146 for Africa's Talking, Clipdrop, StackHawk, and Murf Breaking changes: • KOTS installation is deprecated; users must migrate to Helm installation. • System requirements updated: minimum Kubernetes 1.28/PostgreSQL 15/Redis 6 now recommended 1.32/16/7 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-08-changelog https://docs.gitguardian.com/releases/self-hosted/2025-08-changelog Mon, 18 Aug 2025 00:00:00 GMT GitGuardian Self-Hosted 2025.8 adds AWS ECR detection, Log Collector Helm values, custom webhook selection, Bitbucket Cloud API auth, Valkey support, and W&B/Bitbucket/Mercad • Adds `image.registry` parameter in Helm values to configure the Log Collector image location (Loki, MinIO, Fluent Bit) for air gap deployments. • Adds AWS ECR Container Registry detection for hardcoded secrets. • Adds 3 new secrets detectors: Weights & Biases, Bitbucket App Password, and Mercado Pago. • Enables granular event selection for custom webhooks. • Adds support for Bitbucket Cloud API token authentication in VCS monitoring. • Adds Valkey (Redis 7.2 fork) support for Redis-compatible deployments. Breaking changes: • The required minimum versions have increased: KOTS 1.117.3, Kubernetes 1.28, PostgreSQL 15, Redis 6, ggscout 0.16.6. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-07-changelog https://docs.gitguardian.com/releases/self-hosted/2025-07-changelog Thu, 24 Jul 2025 00:00:00 GMT GitGuardian Self-Hosted 2025.7 adds Jira/Confluence DC historical scanning, ML engine default, v2.143 detectors, and custom tags API. • Adds Jira Data Center and Confluence Data Center historical scanning to scan past content for secrets • Enables the Machine Learning engine by default in 2025.7 with configurable pod priority for resource management • Introduces custom tags API key/value filtering and custom remediation links for workflow automation • Supports GitLab multi-hook configuration for enhanced integration flexibility • Implements auto-ignore invalid incidents playbook to automatically clear confirmed invalid secrets • Adds auto-resolve revoked secrets playbook capability • Introduces Jira DC leaker emails feature for targeted notifications • Improves JWT detection logic to only catch signed JWTs across all detector types • Expands secret detection coverage with v2.143 adding 7 new detectors including GitLab Incoming Mail, Coze PAT, Tavus, Heroku Platform, SSH with port, Tableau Cloud PAT, and Notion v2 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-06-changelog https://docs.gitguardian.com/releases/self-hosted/2025-06-changelog Fri, 20 Jun 2025 00:00:00 GMT GitGuardian 2025.6 adds secret detection for Teams, Container Registries, Jira/Confluence history, and Splunk/Loki/Datadog log export. • Adds `Microsoft Teams` integration for real-time and historical secret scanning in messages • Adds `Jira Cloud` and `Confluence Cloud` historical scanning to detect past secrets • Adds `Container Registries` secret detection for Azure, Google, JFrog, and DockerHub • Enables Self-Hosted export of logs to `Splunk`, `Loki`, `Elasticsearch`, `Kafka`, and `Datadog` • Adds secure API access to secret values via a new endpoint for automation workflows • Adds Kubernetes constraint configuration to limit workers to one per node in deployments • Updates `ggscout` minimum version requirement to 0.16.6 • Requires Kubernetes 1.28 as the new minimum supported version Breaking changes: • Kubernetes 1.27 is no longer supported; clusters must run at least 1.28 • ggscout versions below 0.16.6 are incompatible and must be upgraded Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-05-changelog https://docs.gitguardian.com/releases/self-hosted/2025-05-changelog Thu, 22 May 2025 00:00:00 GMT GitGuardian Self-Hosted 2025.5 adds ServiceNow scanning, SCIM provisioning, customizable incidents view, and NHI policy filtering. • Adds `ServiceNow` secret scanning to detect secrets and honeytokens for automated incident tracking • Adds SCIM user provisioning integration with Okta and Microsoft Entra ID for automated onboarding/offboarding • Adds customizable incidents view allowing creation of custom views with specific properties for prioritization • Adds filtering, analytics, and Secret Reuse policy support to NHI Policies improvements Breaking changes: • Renamed images in this release for air gap deployments; users must update their tooling for downloading and uploading GitGuardian images to their private registry • This release uses Chainguard images without FIPS-approved cryptographic modules; environments requiring FIPS must contact support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-04-changelog https://docs.gitguardian.com/releases/self-hosted/2025-04-changelog Fri, 25 Apr 2025 00:00:00 GMT GitGuardian Self-Hosted 2025.4 adds NHI Governance, custom tags, secrets scope enrichment, and log collector integration. • Adds `NHI Governance` feature to manage and secure Non-Human Identities with lifecycle management • Adds custom tags to categorize and filter incidents in the UI • Adds `Secrets Analyzer` scope, permission, and ownership details to detected secrets for risk assessment • Adds `Log collector for Self-Hosted` integration with Loki, MinIO, and Fluent Bit • Adds Jira DC incident filter support • Adds custom webhook payload configuration option Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-03-changelog https://docs.gitguardian.com/releases/self-hosted/2025-03-changelog Thu, 20 Mar 2025 00:00:00 GMT GitGuardian 2025.3 adds Secret Enricher ML model, ggscout integrations for Jira and secret managers, and v2.133 detection engine. • Adds `Secrets Managers integration` to sync incidents with AWS, HashiCorp Vault, Azure, Google, Delinea, and Akeyless via ggscout • Adds Generic Secret Enricher — ML model that analyzes context to identify secret providers and categories with new filters • Adds Jira ticket templates with Incident ID variable for instant ticket creation • Adds Customizable Public API pagination maximum page size • Adds Automatic license synchronization for non-air-gap environments • Adds nodeSelector support in Helm jobs for enhanced node scheduling flexibility • Updates Secrets Detection Engine to v2.133 with 5 new detectors and 8 improved detectors • Updates Self-Hosted ggscout with Vault preflight checks, hardened Helm chart, Replicated Proxy support, embedded cluster deployment, and support bundle logs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-02-changelog https://docs.gitguardian.com/releases/self-hosted/2025-02-changelog Thu, 20 Feb 2025 00:00:00 GMT New Bitbucket Cloud scanning, custom tags API, enhanced email controls via API, and autoscaling support in v2025.2. • `Search incidents by secret value` enables monitoring secret leaks across thousands of repositories and sources. • Adds `Bitbucket Cloud` scanning capability for real-time detection of exposed credentials in Bitbucket repositories. • Introduces `Custom Tags` via API to organize incidents, with UI support noted as coming soon. • Enhances email incident alerting by allowing management of notification settings and account-level defaults via API. • Adds autoscaling support through `HPA` (Horizontal Pod Autoscaler) for web applications based on demand. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted/2025-01-changelog https://docs.gitguardian.com/releases/self-hosted/2025-01-changelog Mon, 20 Jan 2025 00:00:00 GMT Adds Microsoft Teams alerts, Slack secret scanning, SCIM deprovisioning, and configurable scan limits in GitGuardian Self-Hosted 2025.1 • Adds Jira Data Center auto-tracking to auto-create issues, sync custom fields, and auto-resolve incidents. • Deploys False Positive Remover v1 ML model to halve false positives in Self-Hosted scans. • Enables Slack secret scanning to detect leaked secrets in full history of public and private channels. • Enhances remediation tracking with precise location details and real-time progress monitoring. • Adds `scan_after_push_force_rate_limit` preference to adjust the file tracking engine's scan rate limit. • Implements SCIM user deprovisioning to automatically remove users when they are deleted from the IdP. • Introduces v2.128 secrets detection engine with new Jenkins API, chpasswd, Nessus Agent, and Statsig Server detectors. • Introduces v2.129 secrets detection engine with a new GitLab OAuth detector and improved Base64 High Entropy, GitGuardian Test Token, MSSQL, and Zendesk detectors. • Adds automatic repository monitoring control via the redesigned navigation menu. • Supports Jira Data Center user picker custom fields for integration configuration. • Improves GitHub integration handling for large patches (>100 commits) and enables configurable commit length scanning via `repo_scan_max_commit_length`. • Merges `secrets_checks` queue with `background validity checks` queue to optimize performance. Breaking changes: • PostgreSQL 13 and 14 are no longer supported. PostgreSQL 15 is the minimum; PostgreSQL 16 is recommended. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#2024120 https://docs.gitguardian.com/releases/self-hosted#2024120 Mon, 23 Dec 2024 00:00:00 GMT GitGuardian Self-Hosted 2024.12 adds Jira Data Center, GitLab instance integration, forked repo checks, secret pattern exclusions, and new worker metrics • Adds support for defining secret `Secret pattern exclusion` rules to hide secrets matching defined patterns from incidents. • Allows configuring an instance-level GitLab integration using a read-only admin token. • Enables GitGuardian check runs on GitHub forked repositories to improve code security coverage. • Workspace Managers can disable automatic repository monitoring in VCS integrations to control perimeter expansion. • Adds 7 new secret detectors: X-API Key Secret, Azure Functions App Key Header, Azure Functions App Key Query Parameter, Jenkins API token, chpasswd Username Password, Nessus Agent Key, and Statsig Server Secret Key. • Provides a `Worker Tasks` page in the Admin Area to monitor task activity and worker usage for scaling optimization. • Exposes new applicative metrics: `gim_periodic_task_period_seconds`, `gim_periodic_task_not_run_for_seconds`, `gim_check_runs_long_running`, `gim_health_check_result_count`, and `gim_outdated_health_check_count`. Breaking changes: • The `front.ingress` Helm value has been renamed to `ingress`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#2024110 https://docs.gitguardian.com/releases/self-hosted#2024110 Mon, 18 Nov 2024 00:00:00 GMT Confluence Data Center, ServiceNow integration, bulk historical scans, API scopes, and Helm parameter updates in GitGuardian Self-Hosted 2024.11.0 • Adds `spread_periodic_range_minutes` to replace the deprecated `settings.healthCheck.periodicInterval` for distributing health checks over time. • Adds Confluence Data Center integration for real-time secret detection and honeytoken detection. • Adds ServiceNow integration to create, auto-create, and auto-resolve issues from GitGuardian incidents. • Adds a new 'Bulk Historical Scans Management' page for tracking and filtering historical scans. • Adds `sources:read` and `sources:write` scopes for accessing Sources API endpoints. • Adds `send_email` parameter (`true|false`) to API endpoints triggering notifications to control email delivery. • Allows GitHub custom properties to override GitGuardian global configuration for check runs. • Adds option to deactivate members instead of deleting them. • Adds `replicated.privateCASecret` parameter in Helm values to specify a custom CA for proxy usage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#2024100 https://docs.gitguardian.com/releases/self-hosted#2024100 Mon, 21 Oct 2024 00:00:00 GMT GitGuardian Self-Hosted 2024.10.0 adds VS Code extension, occurrence grouping, filepath exclusions, and new detection engines. • `ggshield` is now available as a VS Code extension that scans files on save and displays highlighted secrets in the IDE • New `grouping` mode in Honeytoken Self-Hosted groups secret occurrences per secret x source for separate incident management • Filepath exclusions can now be scoped to specific repositories via configuration to reduce irrelevant incidents • Certificate-based authentication with CRL support added alongside multi-authentication for service access • New `long-ods` and `long-ods-io` worker types available in Embedded cluster for productivity tools and I/O tasks • Secrets detection engine upgraded to version 2.122.1 adding Atlassian Access Token, Bitbucket Access Token, and Mistral AI API Key detectors Breaking changes: • Users must upgrade KOTS to version 1.117.3 or later before upgrading GitGuardian • Removed resources limits for Postgres and Redis on the Embedded cluster installation require manual review of previous configurations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202480 https://docs.gitguardian.com/releases/self-hosted#202480 Tue, 20 Aug 2024 00:00:00 GMT GitGuardian Self-Hosted 2024.8.0 adds saved views, CAC/PIV auth, Helm updateStrategy config and API feedback_list • Adds `updateStrategy` configuration key to Helm values for customizing rolling upgrade strategy • Adds `feedback_list` field to secret incidents' API payload to expose user feedback via `/v1/incidents` • Supports CAC or PIV card certificate-based authentication (new architecture only) • Adds Saved views in the UI to save and quick-access frequently used filters for secrets • Adds progress estimation and comprehensive scan status details (size, duration, start/end dates, commits, branches, queue) for historical scans • Allows manual triggering of Health Checks from the GitGuardian dashboard • Enables skipping initial historical scan when installing a new GitLab Community Edition integration • Adds `is_team_leader` boolean attribute in API endpoints `/v1/teams/{team_id}/team_memberships` and `/v1/teams/{team_id}/team_invitations` to designate team owners Breaking changes: • The `team_permissions` field has been deprecated and replaced by the `is_team_leader` field in API endpoints `/v1/teams/{team_id}/team_memberships` and `/v1/teams/{team_id}/team_invitations` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202470---required https://docs.gitguardian.com/releases/self-hosted#202470---required Wed, 17 Jul 2024 00:00:00 GMT GitGuardian Self-Hosted 2024.7.0 adds Confluence real-time detection, pending_timeout API status, and Celery monitoring metrics. • `GET /v1/members` and `/v1/invitations` now use the `access_level` field (replacing `role`). • API introduces `pending_timeout` scan status to distinguish queued scans from failed ones. Breaking changes: • The `role` field is renamed to `access_level` in the API endpoints `/v1/members` and `/v1/invitations`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202460 https://docs.gitguardian.com/releases/self-hosted#202460 Mon, 17 Jun 2024 00:00:00 GMT GitGuardian Self-Hosted 2024.6 adds 14 new secret detectors, incidents API endpoint, and configurable platform health checks. • Adds `sourcegraph_access_token_v3`, `duplo_cloud_api_key`, `fernet_key`, `vercel_blob_token`, `asp.net_decryption_key`, `asp.net_validation_key`, `langchain_api_key`, `openai_project_api_key`, `openai_service_account`, `sourcegraph_enterprise_subscription_token`, `sourcegraph_license_key_token`, `sourcegraph_user_gateway_access_token`, `nylas_api_key`, and `wakatime_api_key` to the secrets detection engine (v2.114). • Adds a new API endpoint to query secret incidents for a specific source. • Enables periodic validity checks for previously ignored incidents. • Adds configurable platform health checks for VCS, Messaging, Ticketing, and Documentation integrations with hourly frequency control in the Admin Area. • Introduces email notifications for integration health check failures, controllable via email preferences. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202450 https://docs.gitguardian.com/releases/self-hosted#202450 Wed, 22 May 2024 00:00:00 GMT New detectors for Dropbox/Midtrans/Sanity/Zuplo/GrafanaCloud/Groq/Nx, Jira Cloud integration, Privacy mode, Argo CD support, and Helm config flags • Adds Dropbox Key, Midtrans API Key, Sanity Token, Zuplo API Key, Grafana Cloud API Key, Groq API Key, and Nx Cloud Token to the secrets detection engine (v2.111) • Activates Generic CLI Secret and Generic Database Assignment detectors by default for non-VCS data sources • Introduces Jira Cloud issue tracking integration with automatic incident creation, custom field support, and auto-resolve • Adds `istio.gateway.enabled`, migration resource labels/podLabels, and externalSecrets `RefreshInterval` to the Helm values file • Enables setting initial admin password from an existing secret in the Helm values • Supports Argo CD as an official data source integration • Introduces Privacy mode to obfuscate secrets on the GitGuardian UI • Allows deletion of the AI query history via Filters Breaking changes: • Renamed `celeryWorkers.realtime_ods` to `celeryWorkers.realtime-ods` in configuration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202440 https://docs.gitguardian.com/releases/self-hosted#202440 Wed, 17 Apr 2024 00:00:00 GMT GitGuardian 2024.4.0 adds Jira Cloud honeytoken support, preflight script, and scalable worker-realtime-ods pod • Adds `worker-realtime-ods` pod to the deployment architecture for real-time scanning workloads. • Introduces a new preflight script in Helm releases to verify Kubernetes requirements before upgrade. • Shows secret identity card on each secret incident detail page. • Adds breakdown of secret incidents by severity in the sources API payload. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202430 https://docs.gitguardian.com/releases/self-hosted#202430 Tue, 19 Mar 2024 00:00:00 GMT Slack integration for secrets, AI filtering, GitHub label overrides, and signed images with new architecture support • `slack` integration is now supported for real-time secret detection and honeytoken detection on Self-Hosted. • The `ai_filters_enabled` option in the preferences enables AI filtering of secrets. • The `check_runs_overrides_labels_ghe` option in preferences allows overriding check run settings with repository labels on GitHub Enterprise Server. • GitGuardian images are now signed with Cosign, exclusive to the new architecture. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202420 https://docs.gitguardian.com/releases/self-hosted#202420 Tue, 20 Feb 2024 00:00:00 GMT GitGuardian 2024.2.0 adds CSV export tab separator, GitLab disabled group detection, and HTTP proxy support. • Adds `csv_separator` option to incident exports, allowing tab-separated values instead of the default comma • Adds GitLab integration health check that detects when a group hook is disabled by GitLab • Adds HTTP proxy configuration support in KOTS and Helm installs for the new architecture • Adds Redis Sentinel support in KOTS and Helm installs in the new architecture • Adds multiple CA certificates concatenation support in KOTS install in the new architecture • Adds SMTP server support for self-signed certificates via a new configuration option Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202411 https://docs.gitguardian.com/releases/self-hosted#202411 Wed, 17 Jan 2024 00:00:00 GMT GitGuardian 2024.1.1 adds 8 new secret detectors, source criticality prioritization, Chainguard images, and SMTP/SMTP TLS support. • Adds `base64_aws_iam_key`, `base64_aws_ses_key`, `readme_api_key`, `tailscale_api_key`, `tailscale_oauth_key`, `tailscale_preauth_key`, `tailscale_scim_key`, and `tailscale_webhook_key` to the secrets detection engine v2.102 • Adds a new source-level parameter for prioritizing Secret incidents in GitGuardian Self-Hosted • Switches default images to Chainguard-based builds (KOTS admin 1.104.4 and Replicated SDK 1.0.0-beta.12) on the new architecture • Adds support for unauthenticated SMTP server configuration • Updates KOTS preflights to support TLS for Redis and PostgreSQL connections Breaking changes: • Requires the `btree_gin` PostgreSQL extension to be installed on the database before upgrading, or the upgrade will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#2023120 https://docs.gitguardian.com/releases/self-hosted#2023120 Wed, 13 Dec 2023 00:00:00 GMT GitGuardian Self-Hosted 2023.12.0 adds Azure Repos real-time detection, IP allow-listing for honeytokens, Jira Cloud unassigned issue creation, and Helm private registry supp • Adds `replicasets` to the required Kubernetes RBAC resources list for KOTS upgrades • Adds real-time monitoring capability for Azure Repos repositories • Adds IP allow-listing for Honeytokens via IP rules to prevent triggering events from specified ranges • Enables creation of Jira Cloud issues without assigning them to a user • Adds an onboarding todo list in the UI to guide new users through initial steps • Implements new filtered page filtering mechanism across the platform • Supports Kubernetes versions 1.27 and 1.28 (experimental) for Self-Hosted deployments • Introduces new pod Replicated SDK for license management and telemetry collection in Helm/KOTS installation • Adds support for specifying existing Docker secrets and custom registries in Helm Chart for private image pulls • Adds customization of pod security context configurations via Helm values (`containerSecurityContext`) aligned with Kubernetes v1.25 Pod Security Admission • Adds `custom_telemetry_active` setting in Admin preferences to enable/disable collection of VCS, incident counts, and API call statistics Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#2023110 https://docs.gitguardian.com/releases/self-hosted#2023110 Thu, 16 Nov 2023 00:00:00 GMT GitGuardian 2023.11 introduces team-level alerting API, Honeyton for self-hosted and Chainguard images • Adds `experimental.chainguard` Helm flag to enable reduced-CVE Chainguard-based images (default false) • New REST endpoint to retrieve secret incidents for a specific team via the API • Honeytoken module becomes available for Self-Hosted customers (upon request) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#2023100---required https://docs.gitguardian.com/releases/self-hosted#2023100---required Mon, 23 Oct 2023 00:00:00 GMT GitGuardian Self-Hosted v2023.10.0 adds OpenShift support and upgrades secrets engine • Adds official OpenShift platform support for self-hosted deployment Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202390 https://docs.gitguardian.com/releases/self-hosted#202390 Thu, 21 Sep 2023 00:00:00 GMT GitGuardian 2023.9.0 adds four new secrets detectors and custom detector support for self-hosted users. • Upgrades the secrets detection engine to v2.96 adding Databricks Authentication Token With Hostname, Hashicorp Vault Token, Generic Terraform Variable Secret, and CARTO API Access Token detectors • Enables self-hosted users to create and manage custom detectors tailored to organizational secrets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202380 https://docs.gitguardian.com/releases/self-hosted#202380 Tue, 22 Aug 2023 00:00:00 GMT GitGuardian 2023.8.0 adds Azure AD and Pinecone detectors, incident filters, and exposes metrics on port 9808 • Adds `Azure Active Directory API Keys`, `Docusign API Key`, and `Pinecone API Key` detections in secrets detection engine v2.94 • Adds the Default branch tag to secret incidents occurring on a repository's default git branch • Adds filters to the occurrences table in Incident details • Changes metrics exposure port from 8082 to 9808 for applicative metrics Breaking changes: • The `Custom webhook v1` feature has been replaced by event-based custom webhooks and is deprecated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#202370 https://docs.gitguardian.com/releases/self-hosted#202370 Mon, 17 Jul 2023 00:00:00 GMT Automated severity scoring, custom severity rules, and configurable PAT lifetime in GitGuardian Self-Hosted • Adds automated severity scoring for incidents in Self-Hosted environments • Introduces customizable severity ruleset for automated scoring to improve coverage • Enables managers to enforce a maximum lifetime for personal access tokens via the API • Upgrades secrets detection engine to version 2.93, adding detectors for Tableau Personal Access Token, Yelp API Key, AWS SES Keys, and Forest Admin API Key Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#2023050 https://docs.gitguardian.com/releases/self-hosted#2023050 Mon, 15 May 2023 00:00:00 GMT Secret detectors exposed via API and new detection capabilities in v2.89 • `GET /api/v1/detectors` (or equivalent detectors endpoint) now exposes available secret detector definitions, allowing external tooling to programmatically enumerate supported secret types. • Free-text search field in the secret incidents table now supports filtering by filepaths, enabling precise incident discovery without navigating nested lists. • Secrets detection engine upgraded to v2.89, adding seven new detector rules: Azure Cosmos DB Credentials, Redis Server Password, DigitalOcean Refresh Token, DigitalOcean OAuth Application Token, DigitalOcean Personal Access Token, Cloudinary API keys, and MongoDB Atlas Keys. Breaking changes: • The `comment` field is now required when creating an incident note via the API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#2023040 https://docs.gitguardian.com/releases/self-hosted#2023040 Mon, 17 Apr 2023 00:00:00 GMT GitGuardian Self-Hosted 2023.04.0 adds Keycloak API key detection, customizable remediation workflows, and new API token management endpoints • Upgrade secrets detection engine to version 2.87 with a new detector for Keycloak API Keys • Remediation workflow is now 100% customizable thanks to the deletion of the last static step • API: new endpoints are added for API tokens management (personal access tokens and service accounts) • API: new fields `resolver_id` and `ignorer_id` are available in the secret incident payload Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#2023030 https://docs.gitguardian.com/releases/self-hosted#2023030 Mon, 13 Mar 2023 00:00:00 GMT GitGuardian Self-Hosted 2023.03 adds Azure Repos loader/notifications and API filters. • Adds Azure Repos integration with a dedicated loader and notifications during organization installation • Adds filter capabilities to multiple API endpoints Breaking changes: • Embedded clusters now require PostgreSQL 13; users on older versions must migrate using the documented procedure Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted https://docs.gitguardian.com/releases/self-hosted#2023020 https://docs.gitguardian.com/releases/self-hosted#2023020 Mon, 13 Feb 2023 00:00:00 GMT GitGuardian Self-Hosted 2023.02.0 adds Azure Repos integration and custom remediation workflows. • `Azure Repos` native integration for secret detection and policy breaks • Custom remediation workflow configurable in settings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gitguardian-self-hosted