DockerHub

Limited availability

DockerHub monitoring is currently available to selected workspaces. Contact your Customer Success Management team to request access.

GitGuardian Public Monitoring scans public DockerHub container images to detect secrets exposed inside them. Secrets frequently end up baked into image layers - in build artifacts, configuration files, or environment data - where they remain accessible to anyone who pulls the image.

What we scan

GitGuardian analyzes the layers of public DockerHub images - the filesystem layers that make up an image - and detects secrets in their content.

Scan model

Continuous ingestion, one-off attachment. GitGuardian continuously ingests public DockerHub data into its own database. When DockerHub monitoring is enabled for your workspace, GitGuardian runs a one-off pass that matches the stored occurrences against your perimeter.

This attachment is a point-in-time operation: it covers the data ingested up to the day it runs, and it is not re-run automatically yet. Occurrences ingested afterwards are not attached to your perimeter until ongoing scanning is available - see Limitations.

Attachment reasons

A secret found on DockerHub is attached to your company through your perimeter when it matches one of:

• Secret grasper - a secret grasper from your perimeter is found in the image content. This is the most common reason.
• Domain in secret value - a domain from your perimeter appears inside the secret value itself.
• Domain in owner profile - the DockerHub account that published the image has a domain from your perimeter in its public profile (for example, in the account's public email). The match is made on the published account's metadata, so the publisher does not need to be one of your monitored developers. In the dashboard, these incidents appear under the By dev from perimeter attachment reason.

Incident context

DockerHub incidents differ from GitHub incidents in the context they provide. Instead of a commit author and commit, you see:

• the image owner account (user or organization),
• the image and repository,
• the layer the secret was found in.

Occurrence date

For findings dated January 2025 onward, the occurrence date is precise - it reflects when the secret was actually exposed on DockerHub.

For older findings, treat the date with caution: it may reflect GitGuardian's historical backfill rather than the original exposure.

Limitations

• Continuous monitoring - coming soon. For now, attachment runs as a point-in-time historical scan over the DockerHub data ingested up to that point (not re-run automatically yet). Ongoing, incremental scanning of new content is on the way.
• No presence checks. GitGuardian does not yet verify whether a secret is still publicly exposed on DockerHub, so these findings carry an Unknown presence status rather than a checked one.
• Large file contents are skipped. File contents larger than ~10 MB within an image are excluded, so a fraction of image content is not scanned.