5 articles tagués avec « self-hosting »

Version	Release Date
2026.10.0	October 20, 2026
2026.10.1	October 23, 2026
2026.10.2	October 26, 2026

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Kubernetes 1.36 is now supported. The chart ships ggscout 0.33.0, the version that sends Azure Key Vault, GitLab CI and Akeyless tags for environment classification; upgrade any ggscout you run outside the cluster to get them.

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

⚠️ Important: This is a required release and cannot be skipped.

⏳ Background migrations: recent releases run data migrations in the background after the upgrade, and an upgrade is refused with Not all required migrations have been applied while the ones it depends on are still running. Wait for them to finish, then retry. This can apply to the upgrade to 2026.10, and some must finish on 2026.10 before you can upgrade to 2026.11.

Feature highlights​

• Wiz integration: your active secret incidents from version control sources sync to Wiz every day as native secret findings, with their detection context and a link back to GitGuardian, but never the secret value. Your instance needs outbound HTTPS access to your Wiz tenant. Learn more.
• Source status: every source now shows whether it is Monitored, Unmonitored, Unreachable, Archived or Deleted at the provider. Filter on the status from the perimeter page and the incident list, and save it as a view, for example to set aside incidents from archived or deleted repositories. Learn more.
• Unreachable integrations pause, then resume once reconnected: when an integration can no longer reach its instance, for example after a token expires or during a provider outage, GitGuardian pauses real-time ingestion and historical scans on its sources, shows the step to fix it, and resumes them on its own once the connection is back. This now covers GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Confluence, Slack and Microsoft Teams on Self-Hosted. Learn more.
• Richer vault metadata, environments classified per secret: ggscout 0.33.0 now collects Azure Key Vault secret tags, GitLab CI environment scopes and Akeyless item tags. NHI Governance uses them, with the secret path, to infer the environment of each secret, and falls back to the source-level env of your ggscout configuration only when nothing resolves. The classified environment feeds the exploration map, the cross-environment secrets policy and the risk criticality. Learn more.
• AI Hooks keep leaked tool output away from the model: on Claude Code, Codex and Mistral Vibe, a tool output that contains a secret is withheld from the assistant. AI Hooks and the AI agents and MCP inventory now also cover Amazon Kiro and Junie CLI. Requires ggshield 1.55.0 or later. Learn more.

Secrets Detection Engine​

• v2.172: 10 new detectors (Brightcove OAuth Credentials, Infor ION API Credentials, Generic Sanctum Token, Telnyx API Key, Bifrost Virtual Key, Bitbucket HTTP Access Token with Prefix, Jira Data Center Personal Access Token, MetaApi Cloud Token, Appwrite Encryption Key, APIclub API Key), 10 improved detectors (Salesforce OAuth2 Keys and Splunk Authentication Token now capture the instance host, Scaleway Token, Username Password in Spanish, Portuguese, French and Turkish, Google API Key, Generic Database Assignment, Generic High Entropy Secret, Generic Encryption Key), 2 new checkers (Splunk Authentication Token, Artifactory Reference Token, both with custom host support), 8 new analyzers (AWS Cognito, Alibaba Cloud, Databricks, PyPI, Contentful, three DigitalOcean token types), 1 analyzer update (Figma Personal Access Token).
• v2.173: 9 new detectors (Ory API Key, Kong Konnect Personal Access Token, AppSignal API Key, PostHog OAuth Access and Refresh Tokens, Datadog Service Access Token, NinzaSMS API Key, TypeSafe AI API Key, Mistral AI prefixed API Key), 5 improved detectors (Azure Cache for Redis Access Key, Databricks Authentication Token With Hostname, Okta Token with Host and Mistral AI checkers, Base64 Basic Authentication), 1 new analyzer (Cohere API Key).

Enhancements​

• The API timeout of ggshield can be configured, GitLab system hooks integrations with a non-admin token monitor personal namespaces and project-only groups, two new team perimeter settings keep unmonitored sources in teams or remove archived ones, audit log CSV exports detail the secrets exported, and the public API adds author attribution for custom sources and covers Public Monitoring secrets in the secret value and validity endpoints. Learn more.
• Developers can reply to a GitHub check run from the pull request with @gitguardian, the source status filter gains an is all of operator, the public API can trigger a presence check, Confluence Data Center occurrences carry the stable user key, and table row selections survive navigation. Learn more.
• The public API can find the GitHub check runs that reported an incident and skip a blocking one, so your own approval flow can unblock a pull request. Learn more.
• Self-Hosted:
  • The license expiration banner now shows only to workspace owners, managers and Admin Area users, the people who can renew the license, instead of every member.
  • The task scheduler exposes Prometheus metrics like the workers do, on a port set with beat.metricsPort. When ServiceMonitors are enabled, the chart creates one for it.
  • New embedded cluster installs deploy ClickHouse by default, like PostgreSQL and Redis, so analytics work out of the box.
  • The embedded cluster preflight checks now expect at least 12 CPU cores and 48 GiB of memory, up from 8 and 30. A smaller VM fails the check without blocking the upgrade: size it to the system requirements.

Fixes​

• Historical scan summary emails are no longer sent many times, a user can no longer add their own organization to a private GitHub integration on self-hosted instances that use a public GitHub app, and a OneDrive installation missing Graph permissions is now marked unhealthy instead of silently stopping. Learn more.
• Self-Hosted:
  • A ClickHouse schema migration interrupted partway now completes when it runs again, instead of failing on the tables and columns it had already created.
  • The ClickHouse schema migration now works when the ClickHouse user, password or database name contains special characters such as @, % or /.
  • Pod labels, annotations, node selectors, tolerations, priority class and environment variables set under global.* now reach the chart's pods that ignored them: the migration jobs, the upgrade path check, the remote preflight checks and the nginx CRL jobs. global.podLabels also reaches ClickHouse and Keeper, so a label required on every pod, such as the Google Cloud Marketplace usage label, no longer goes missing. The bundled replicated, loki and loki-minio subcharts read only some of them: the Helm values reference lists the keys to set on them instead.

Hotfixes​

2026.10.1​

  Release Date: October 23, 2026

Fixes​

• Security: the private keys of the eMudhra certification authority were compromised, so certificates forged from its roots could be accepted as valid. GitGuardian components now use an updated CA bundle that no longer trusts these roots. Upgrade as soon as possible.

2026.10.2​

  Release Date: October 26, 2026

Fixes​

• Security: the Brotli compression library in the GitGuardian backend image was affected by CVE-2026-111497, a critical out-of-bounds write in its decoder, reachable through outbound TLS connections. The GitGuardian images are now built on base images that ship the patched library. Upgrade as soon as possible.

Version	Release Date
2026.9.0	September 25, 2026

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

The ggscout minimum moves to 0.32.0, the first version that classifies collected secrets with the Secrets Detection Engine. The chart ships 0.32.0; upgrade any ggscout you run outside the cluster.

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

Feature highlights​

• AI Hooks for Codex and Mistral Vibe, and the AI agents and MCP inventory: AI Hooks now block secrets inside Codex and Mistral Vibe, alongside Claude Code, Cursor, Copilot CLI, and VS Code. The new inventory shows which AI agents and MCP servers run on each endpoint, whether hooks are installed, and whether an agent runs under a personal or a company subscription. The inventory is unlocked by the Endpoints entitlement of your license and requires ggshield 1.54.0 or later. Learn more.
• Vaulted secrets classified by value: ggscout now runs the Secrets Detection Engine on every value it collects, so the NHI inventory can filter by detector, detector type, secret family, category, and provider. Requires ggscout 0.32.0 or later. Learn more.
• Honeytoken protection on endpoints: ggshield plants a decoy AWS credential in the file credential-harvesting malware reads first, so any use of it raises an alert naming the compromised endpoint. A coverage card in the Endpoints dashboard tracks the share of your fleet that is protected. Requires Endpoint Protection, Honeytoken, and ClickHouse on your instance. Learn more.
• GitGuardian Bridge on Self-Hosted: scan sources that live in an isolated network, such as a GitLab instance behind a firewall, without opening an inbound connection into it. You install the bridge server yourself, declare each bridge in your Helm values under GGBridge.bridges, and the bridge client inside the isolated network dials out to it. Learn more.

Secrets Detection Engine​

• v2.170: 6 new detectors (Firebase ID Token, Coze Access Token, Keycloak Access Token, Keycloak Refresh Token, Fish Audio API Key, Azure Custom Vision Training Key), 8 improved detectors (Fastly Personal Token and Scaleway Token precision, Docker Hub personal access tokens used with docker login --username, revoked-key detection for the three New Relic checkers, Bitbucket Keys checker no longer reports invalid credentials as valid, Google OAuth2 Keys banlist), 1 new analyzer (Apify Token), 1 analyzer fix (Google Cloud Keys).
• v2.171: 7 improved detectors (n8n API Key and n8n MCP Access Token host detection, Hashicorp Vault AppRole Authentication recall, Generic High Entropy Secret no longer reports variables ending in checksum, fixed Scaleway Token, Workato API Key and Open VSX Access Token checkers), 2 new analyzers (Akamai API Credentials, Docker Credentials), 3 analyzer updates (GitLab Token, Figma Personal Access Token, OpenAI API Key).

Enhancements​

• SSO and SCIM sign-in now works when the identity provider supplies no first and last name, which are derived from the user's email address instead. Learn more.
• Linked Jira tickets get comments for more incident events (reassignment, regression, validity, access grants and revocations, public sharing, feedback), per-team incident permissions can be set when promoting a user to Member, and the unhealthy integration banner shows only to managers and owners. Learn more.
• Self-Hosted:
  • ClickHouse is now covered by the Admin Area Health check page, the admin banner, and the notification emails: reachability over HTTP, metadata volume fill level against a configurable threshold, and backup freshness read from the backup sidecar. When ClickHouse is down, only reachability turns red and the other two checks report the reason instead of guessing. Its logs and collectors are included in the support bundle, and the ClickHouse and backup sidecar Prometheus metrics come with recommended thresholds and alerts. ClickHouse remains optional in 2026.9. Learn more or see the health check page.
  • The in-app analytics job can write to PostgreSQL schemas you choose, through inAppAnalytics.postgresql.applicationSchema, useSeparateAnalyticsSchema and analyticsSchema, for databases that forbid the public schema or cannot grant CREATE to the GitGuardian user. Leaving them unset keeps the current layout. Learn more.
  • The support bundle pod can be scheduled with replicated.supportBundle.nodeSelector, tolerations and affinity, for example on tainted nodes, and the Admin Area now reports why a support bundle pod cannot be scheduled instead of waiting silently.
  • Your own MCP gateway can be registered as an OAuth callback through mcpServer.oauth.extraRedirectUris.
  • GitHub app installations made outside the dashboard, for example from the app's public GitHub page, no longer join the monitored perimeter on their own. They wait on the GitHub or GitHub Enterprise Server settings page until an Owner or a Manager approves or rejects them. Installations started from the dashboard are unaffected.
  • Validity checks can leave a detector's default host out and check secrets against your custom hosts only, which matters on air-gapped networks that cannot reach the vendor's public host. Learn more.

Fixes​

• Invalid incidents that a playbook filter should have ignored are now ignored, missing scan statuses were added to the pygitguardian client and the API documentation, Jira Cloud recurrent scans no longer fail on multi-page issue listings, and an integration no longer remains out of sync after a GitHub outage. Learn more.
• The revoke button is displayed again for revocable secrets to members with Full Access. Learn more.
• Uninstalling a GitLab integration no longer fails. Learn more.
• Source locations are no longer recomputed too frequently, which caused excessive repository clones and bandwidth usage. Learn more.
• Self-Hosted:
  • ClickHouse pods failed to start with ImagePullBackOff because the volume-permissions init container image could not be pulled. The init container now uses the wolfi/bash image the chart already ships.
  • The MCP server image is pulled through the Replicated proxy like every other image, so proxy-only installs no longer need direct access to ghcr.io.
  • The chart no longer creates proxy Secrets on installs that set no proxy URL.
  • Loki queries no longer miss log lines. After a log rotation, gunicorn workers could keep writing to several log files at once while fluent-bit tailed only one of them. The log file is now rotated once across all forked workers.
  • Triggering an ML backpopulate scan from the Admin Area gives immediate feedback again, and the same run can no longer be started twice. This was a 2026.8.0 regression.
  • Endpoint scans sent by a newer ggshield are accepted even when they carry fields the server does not know yet, instead of being rejected.

Version	Release Date
2026.8.0	August 27, 2026
2026.8.1	September 8, 2026

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

Feature highlights​

• ClickHouse on Self-Hosted: a new optional, in-cluster column-oriented database that powers features needing fast analytics over large volumes of data, starting with Endpoint Protection. It is deployed as a single-node StatefulSet backed by object storage you provide (S3-compatible, with Azure Blob Storage and GCS in progress), ships a clickhouse-backup sidecar for scheduled backups, and is available on both Helm and KOTS installs. PostgreSQL remains the primary datastore for the rest of the application. ClickHouse is optional in 2026.8 and becomes mandatory in 2027.1.0. Learn more or read the customer notice.
• GitHub check runs page: a dedicated Check runs page in the Perimeter section brings every check run into the dashboard with its status, repository, commit, and linked pull request. Filter and search across hundreds of thousands of runs, re-run or skip a check without switching to GitHub, and jump straight to the incidents a run detected. Learn more.
• Mention members and teams in incident notes: type @ in an incident note or feedback to mention a member or a whole team and notify them by email, on both Internal Monitoring and Public Monitoring incidents. Learn more.
• Set your own validity status by API: run the validity check yourself on the internal systems GitGuardian cannot reach, then send valid or invalid back with one API call. Incidents display Custom validity with the date it was set, and the change is recorded in the incident activity log and your audit log. Learn more.
• A smarter search bar: the unified filter bar is now enabled on self-hosted, letting you find incidents by secret value, commit author, or file path. Plain-English search (AI Filters) is included for self-hosted, but it only becomes available once a workspace administrator turns on the External LLM toggle under Settings > Workspace > AI and an LLM provider is reachable. Learn more or see AI Settings.

Secrets Detection Engine​

• v2.167: 11 new detectors (Azure SQL Credentials, Azure Machine Learning Key, Azure Video Indexer Key, Azure Health Insights Key, Azure Fluid Relay Key, LiteLLM API Key, DashScope API Key, Apify Proxy Token, Authress Access Key, and two Gemfury token variants), 3 improved detectors (Datadog API Credentials, Snyk Key, Okta Token with Host), 6 new or upgraded checkers (LiteLLM Without Host, LaunchDarkly SDK Key, Llama Cloud API Key, New Relic APM License Key, npm Token, Hume AI API Key), 1 analyzer fix (Figma Personal Access Token).
• v2.168: 4 new detectors (Azure Immersive Reader Key, DashScope Coding Plan API Key, DashScope Token Plan API Key, Prefect Cloud API Key), 2 new checkers (Alibaba Cloud IAM, GitLab Deploy Token), 7 improved detectors (Generic High Entropy Secret, Okta Token with Host, and HTML/Markdown scanning extended to npm, GitHub Personal Access, GitHub OAuth, GitHub App and Slack Application tokens), 2 hardened checkers (Auth0 Keys, Microsoft Power Apps Webhook).
• v2.169: 7 new detectors (Slack Webhook Trigger URL, n8n API Key, Atlassian Auth Key, AWS Cognito Access Token, OpenAI Access Token, Vercel OIDC Token, OpenCode API Key), 1 new checker (Supabase Service Role JWT), 15 improved detectors (GitHub and npm format validation, Generic Password, Generic High Entropy Secret, AWS IAM Keys, PostgreSQL Credentials, Azure Event Hub and Service Bus checkers, and more), 4 analyzer fixes (GitHub Enterprise custom host URLs, Google API Key 403 handling), 1 removed (Grafbase Access Token) and 1 disabled (Amadeus OAuth Credentials) as both services were discontinued.
• v2.169.1: 2 new detectors (Lovable Access Token, Lovable Git Token), and 4 improved detectors, where values failing format validation are no longer reported by generic detectors for GitHub Personal Access, GitHub OAuth, GitHub App and npm tokens.

Enhancements​

• Fine-grained GitHub personal access for private members monitoring (Public Monitoring perimeter); removal of the Display as Tree view from integration source pages for better performance on large perimeters. Learn more.
• Personal Access Tokens and Service Account Tokens can now be created through the public API for automated rotation workflows, automatic monitoring and automatic scan toggles reached Jira Cloud, Jira Data Center, Confluence Cloud, Confluence Data Center and Microsoft Teams, and a new Azure DevOps extension adds a ggshield scan job to every pipeline in an organization with a single pipeline decorator. Learn more.
• The "Only use detectors with validators" option is now settable on custom sources through the public API, and tooltips on disabled source actions explain why monitoring, criticality, or team assignment is unavailable. Learn more.
• Self-Hosted: Added tunable emptyDir volume limits for the ml-secret-engine pod in the Helm chart.

Fixes​

• Multi-factor authentication emails now reach users who were globally unsubscribed in the email delivery system, push events no longer trigger a full repository clone when cached data is available, the Slack integration no longer monitors channels that were not manually added when auto-monitor is off, and incident feedback mentions display the member's name instead of a raw identifier. Learn more.
• Scans triggered via a Personal Access Token now emit an audit log event, the "Edit issue" dialog no longer closes unexpectedly, notifier team names are populated on workspaces with more than 100 teams, deactivated members no longer appear in the grant access dialog, a disabled detector can no longer block a pull request through GitHub check runs, the JFrog Container Registry reachability check now routes through ggbridge, GitLab sources marked as monitored are reflected in the perimeter view, and the decoded claims panel of a JWT secret no longer breaks on malformed claims. Learn more.
• A missing endpoint was added to the OpenAPI specification, incident IDs are displayed in the ID column again, an off-by-one issue in the dashboard date filter was corrected, and bulk scan requests no longer fail when enqueuing a very large number of sources at once. Learn more.
• Self-Hosted:
  • Celery worker pods failed their liveness and readiness probes on FIPS images and never reached a ready state, which blocked the deployment from completing.
  • The in-app analytics dashboards no longer query Public Monitoring data or report a monitored perimeter developer count on self-hosted instances, where neither is applicable.

Hotfixes​

2026.8.1​

  Release Date: September 8, 2026

Enhancements​

• NHI Governance: AWS access keys stored in a secrets manager, Vault, or Kubernetes are now linked to their AWS IAM identity in the identity map.

Fixes​

• Validity checks: validity check results and incident creation events are now processed as soon as they arrive on self-hosted instead of piling up.
• Images versions: Basalt 0.8.1 and Loki 3.7.7 bumps, see the air gap install page for the updated tags.

Version	Release Date
2026.7.0	July 24, 2026

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

⚠️ Important: This is a required release and cannot be skipped.

Feature highlights​

• Public Monitoring on Self-Hosted — Public Monitoring is now available on self-hosted instances (license-gated). Monitor your public perimeter for secret leaks, and route public secret incidents through the full alerting and ticketing stack: custom webhook, Slack, and Microsoft Teams notifications, ServiceNow ticketing, plus email alerting filtered by public incident severity. Enable the optional celeryWorkers.public-monitoring worker to process the Public Monitoring queues. Learn more.
• Gerrit secret scanning — native Gerrit VCS source with full historical scanning, real-time detection via the webhook plugin, and read-replica support for cloning. Learn more.
• Smart Notifiers — filter alerts and tickets by incident criteria — define per-channel rules so an alert, ticket, or email is only created for the incidents that matter, filtering by severity, validity, secret type, or GitGuardian tag, across internal and public monitoring. Learn more.
• GitHub check runs — mitigate API rate limits — oversized pull requests are now scanned by cloning the repository branch instead of calling the GitHub API commit by commit, and check runs can skip merge commits, protecting your shared GitHub API rate limit. The check run size thresholds and rate-limit behavior are customizable from the admin area GitHub preferences. Learn more.
• Gateway API routing & autoscaling — route external traffic through the Kubernetes Gateway API instead of the legacy Ingress resource, and scale webapps with Kubernetes HPA or KEDA autoscaling. Learn more.

Secrets Detection Engine​

• v2.166 — 9 new detectors (Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, and five Azure services: Maps, Mixed Reality, Service Bus, Quantum, Bot Direct Line), 2 new checkers (Gemfury Deploy/Push Token, Gemfury Full Access Token), 3 detector improvements (LiteLLM API Key, GitLab runner authentication token, Artifactory Token With Host), 2 analyzer updates (Google Cloud Keys, GitLab Token).

Enhancements​

• Jira Notifier now exposes remediation guidance and detector-specific links as assignable fields in the ticket description template. Learn more.
• Custom Sources (BYOS) option to scan with validated detectors only. Learn more.
• Self-Hosted:
  • The daily analytics job can now write its Spark scratch data to a dedicated ephemeral volume instead of the node's local disk, preventing job failures from node ephemeral-storage limits on large workspaces. Learn more.
  • New opt-in mcpServer deployment (Helm only) to run the GitGuardian Remote MCP server in your own cluster, next to your instance, so no traffic and no secret leaves your network. Point Claude, Cursor, or any MCP client at your instance to scan for leaked credentials, manage incidents, and deploy honeytokens without leaving the IDE. Disabled by default and currently in beta; set mcpServer.enabled: true to deploy it. Learn more.

Fixes​

• Security fix preventing a Service Account Token from revoking itself through the public API; incident assignment now auto-grants access to the assignee; privacy-mode line misalignment in incident details; clearer error for unreachable custom webhook URLs; auto-grant developer access playbook corrections; JFrog Container Registry now discovers all repositories; GitLab health check no longer marks a reachable instance unavailable on a 4xx response. Learn more.
• Discord webhook alerts now trigger correctly; False Positive tag display and filtering in the incidents dashboard; Team Perimeter tree/list selection state; NHI Inventory "files requiring code fix" count consistency between UI and API. Learn more.
• Self-Hosted:
  • Enabling observability (CloudWatch) on AWS EKS no longer breaks the readiness and liveness probes.
  • Fixed a database compatibility issue that could cause the daily in-app analytics job to fail, so your analytics dashboards stay up to date.
  • The risk score is not computed on self-hosted yet, but its filter, incidents table column, incident detail banner, and notifier filter were still displayed. They are now hidden, so you no longer get a filter that returns nothing. They will come back when the feature reaches self-hosted.

Version	Release Date
2026.6.0	June 19, 2026
2026.6.1	June 23, 2026

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

Feature highlights​

• Premium scan retry worker (Helm only) — a new optional, dedicated worker retries failed premium (VCS) scans on a high-memory pod. Large repositories that fail a scan — most often on out-of-memory errors — are retried here instead of repeatedly failing on the standard scanner pool. This lets you keep your base worker-scanners pods small and route only the heavy retries to one or two large, scale-to-zero pods. Learn more.
• Open-source agent skills for ggshield — the new GitGuardian/agent-skills repository ships open-source skills that teach AI coding assistants like Claude Code and Cursor when to scan, how to read findings, and how to walk developers through remediation. Learn more.

Secrets Detection Engine​

• v2.163 — 6 new detectors (Aikido API OAuth2 Credentials, Logflare Access Token, PolyAPI API Key, Apollo.io API Key, AES Cipher Key, SAP OAuth Credentials — replacing sap_ai_core_credentials), 1 new checker (SAP OAuth Credentials), 3 detector precision/format improvements (Azure DevOps PAT, GitHub App Token, Pagar.me API Key), 1 updated checker (Coralogix Personal Key), 2 analyzer updates (Datadog API Credentials, Azure OpenAI).
• v2.164 — 6 new detectors (Authentik API Token, Pagar.me Encryption Key, Adobe Refresh Token, LiteLLM API Key, brapi.dev API Key, Open VSX Access Token), 1 new checker (Google OAuth2 Keys), 6 detector precision improvements (Snyk Key, Finicity Authentication Keys, Hunter API Key, Datadog API Credentials, GitHub PAT, Heroku Platform Key), 1 new analyzer (Adafruit IO API Key).
• v2.165 — 8 new detectors (Stitch API Key, ActiveMQ Credentials, Instantly API Key, Gitea Access Token, Fal.ai API Key, SurrealDB Cloud JWT Token, Kimi API Key, Wiz OAuth Credentials), 8 new checkers (Okta Token, Okta OAuth Credentials, Azure Communication Services Connection String, Azure Storage Account Key, AWS Cognito OAuth 2.0 Credentials, LaunchDarkly SDK Key, Pulumi Access Token, Python Package Index Key), 6 updated checkers (AWS IAM Keys — all regions, Sumo Logic Keys, Supabase API Key, Vultr Key — v2 API, Baidu AI API Key, SAP OAuth Credentials), 1 detector precision improvement (Azure Active Directory API Keys).

Enhancements​

• Microsoft Teams granular alerting for internal monitoring — subscribe to specific incident event types per channel for fine-grained control over notification preferences. Learn more.
• Jira Cloud recurrent scanning instead of webhooks, and VCS historical scans now cover orphaned commits, Git notes, and pull/merge request refs. Learn more.
• Overview analytics now include NHI; GitHub check runs can skip merge commits; dissociate Jira/ServiceNow tickets from incidents; GitLab read-only group hook tokens. Learn more.

Fixes​

• Fixed an issue where unmonitored sources were incorrectly displayed as deleted in the user interface. Learn more.
• Security XSS fix on the mTLS redirect page; custom remediation guidelines now shown on developer share links; Jira & Confluence rate-limit scanning error; GitHub Forbidden error on unauthenticated API root requests. Learn more.
• Self-Hosted: Fixed an in-app Analytics failure that blocked the analytics run from completing.

Hotfixes​

2026.6.1​

  Release Date: June 23, 2026

Fixes​

• ggshield: Fixed ggshield auth login on self-hosted.