Remediate findings

A machine scan surfaces findings of different kinds, and each kind calls for a different action:

• Overprivileged secrets: such as secrets with admin permissions. Remove them from the machine and store them in a vault or password manager.
• Leaked secrets: secrets that ended up in shell history or log files. Redact them and prevent future leaks.
• Secrets you actively use: secrets your daily work relies on, typically stored in env files. Move them to a vault to keep using them safely.

Remove overprivileged secrets

Admin-level secrets shouldn't sit on a workstation, but not every finding deserves an incident. Review the findings in the GitGuardian dashboard and create incidents for the ones that call for action:

1. In the GitGuardian dashboard, go to the Endpoint protection > Secrets page.

   

2. Optionally, select the Highly privileged & Valid filter to narrow the list down to the secrets with admin permissions.

   

3. Review the findings. A finding warrants an incident when the secret is valid and carries more permissions than work on the endpoint requires: admin scopes, organization-wide access, or write access to production systems.

4. For each finding that needs action, click Create incident and assign the incident to the relevant member. Bulk actions let you create several incidents at once.

   

5. Follow the incident remediation workflow to revoke the secret and remove it from the machine.

Prevent overprivileged secrets

• Use fine-grained or lower-permission tokens. Most services offer permission granularity: create tokens with only the permissions you need.
• Keep admin tokens in a vault. Most daily tasks don't require admin permissions. Store admin tokens in a vault and use them only when really needed.

Redact secrets in shell history and log files

Secrets that leaked into shell history or log files serve no purpose there. The redact action rewrites the file in place: only the secret itself is replaced with [REDACTED], the rest of the line and the file stay untouched. Your history and logs remain readable, minus the credentials.

To use a different placeholder, set the remediation.scrub_redact_string option in the Configuration page of the local dashboard.

warning

Redaction cannot be undone.

1. Open the local dashboard:

   ggshield machine dashboard

2. Go to the Findings page.

   

3. Select the Auto-fixable filter to show findings where at least one occurrence can be scrubbed automatically.

   

4. Select all results with the main checkbox. Use Select all x matching if the results span multiple pages.

   

5. Click Redact selected.

Prevent future leaks

Block AI agents from reading secrets. AI coding agents can read secrets from any file they have access to, and anything they read ends up in plain text in their logs, session transcripts, and shell history. Install the ggshield AI hooks to stop them from accessing files that contain secrets.

Keep secrets out of shell history. Use a variable instead of a plaintext secret in your commands:

psql "postgresql://admin:${DB_PASSWORD}@db.example.com:5432/mydb"

Move the secrets you use to a vault

Some secrets are needed for daily work. They usually live in .env, .bashrc, and similar files. Using them is legitimate, but they belong in a vault or secrets manager.

GitGuardian doesn't offer an official solution to relocate them yet. In the meantime, move them to your vault manually.