Sync your GitHub teams, members, and perimeters automatically

  Release Date: October 29, 2026

Teams are what makes GitGuardian scale across an organization: they scope incident access to the right people and send each alert to those who can act on it. You can already fill them from your identity provider with SCIM, and build any structure you need with our Public API.

Your GitHub organization is now a source of truth too. Enable team sync on your GitHub integration and GitGuardian mirrors it in your workspace: the teams, their members, and the repositories they own.

What does this mean for you?

• Teams created for you: Every team in your GitHub organization is created in GitGuardian, sub-teams included. Nesting is flattened, and a child team keeps its parent in its name so the structure stays readable.
• Members added with the right permissions: Each member gets the GitGuardian permission matching their access level in GitHub, and team maintainers become team leaders. A role change in GitHub is applied on the next sync.
• Kept in sync, with a history: Synchronization runs every 24 hours, and you can trigger it any time with Sync now. The synchronization history lists each run with its status, its trigger, its duration, and the changes it applied.

Why is this important?

When your teams mirror GitHub, every incident reaches the developers who own the code, and remediation starts with the people best placed to fix the leak. Onboarding becomes a single switch instead of a mapping exercise, and your access rights stay accurate as your organization grows.

Requirements

Team sync needs a GitHub organization where GitGuardian can read member emails, which is how it matches GitHub users to GitGuardian members: typically a GitHub Enterprise Cloud organization with SAML SSO.

Get Started Today!

Open your GitHub integration settings, scroll to Team synchronization, click Add organization, and select the organization to mirror. Learn more about team synchronization.

Enhancements

• GitGuardian Bridge: Validity checks and secret analysis now go through your bridge for detectors where GitGuardian reads the host from the secret itself, such as database connection strings, whenever that host is mapped to a bridge. Validity checks through the bridge were previously limited to detectors with a custom host configured. See the supported integrations.
• Custom webhook: You can now add several custom headers to a custom webhook from its settings, so your endpoint can authenticate GitGuardian requests its own way, for example with a bearer token or a routing header.
• Public API:
  • A new endpoint unlinks a ticket from an incident.
  • New endpoints return the stored content of an occurrence of an internal or public incident in clear text, under the same requirements as secret values. Read more.
• Endpoint Protection: The authorization page of ggshield auth login now groups the Endpoint Protection scopes in a single opt-in card, no longer granted by default, so users who only need pre-commit or AI Hooks scanning grant only the scopes they use.

Fixes

• SAML SSO: Fixed an issue where a member provisioned by SCIM could hit an error on their first SAML sign-in.
• Google Artifact Registry Integration: Fixed an issue where Google Artifact Registry integrations with a monitored package were reported as unhealthy, which paused their syncs and scans.
• Public API: Fixed an issue where assigning an incident with a service account token did not send the assignment email to the assignee.