Public Monitoring for self-hosted installations
Public Monitoring is available on self-hosted GitGuardian installations starting with the 2026.7 release. This page explains how the feature works on a self-hosted instance, how to enable it, and the network requirements it introduces.
Public Monitoring is a business feature that requires a specific license. Contact us for availability and pricing information.
For a general introduction to the feature, see Public Monitoring core concepts.
How Public Monitoring works on self-hosted
Unlike most GitGuardian capabilities, Public Monitoring does not scan public sources from your own instance. Public sources (public GitHub, DockerHub, and others) are continuously scanned by GitGuardian's hosted Public Monitoring service. Your self-hosted instance connects to that service to retrieve the public secret incidents that match your company's public perimeter.
Two consequences follow from this model:
- Your public perimeter is defined and stored on GitGuardian's side, within the hosted Public Monitoring service, not on your self-hosted instance. The instance retrieves the incidents that match it.
- The connection is always outbound and initiated by your instance. GitGuardian never initiates a connection into your self-hosted instance.
Public Monitoring relies on outbound connections to GitGuardian's Public Monitoring service. Your instance must be able to reach the domains listed under Network requirements. A fully isolated installation that cannot reach them cannot use Public Monitoring.
Enabling Public Monitoring on self-hosted
Enabling Public Monitoring on a self-hosted instance is a two-part process: GitGuardian enables it on your license, then an administrator completes the setup from the Admin area.
1. Request activation and synchronize your license
Public Monitoring is controlled by a dedicated license field that is disabled by default. To enable it, contact your GitGuardian representative or support@gitguardian.com.
Once GitGuardian has enabled the field, ensure the application's license is synchronized accordingly. After synchronization, a Public monitoring page becomes available in the Admin area, under Settings.
2. Configure the connection
GitGuardian provides you with a pair of credentials (a Client ID and a Client secret) that your instance uses to authenticate against the hosted Public Monitoring service.
- Open the Admin area of your GitGuardian dashboard (administrative rights required).
- Go to Settings > Public monitoring.
- Click Edit, enter the Client ID and Client secret provided by GitGuardian, and click Confirm.
Once the credentials are saved, a confirmation message appears and your instance begins retrieving public secret incidents that match your perimeter.
Health checks
Your instance continuously verifies that the integration is correctly configured and reachable. These checks appear on the Health Checks page in the Admin area:
- Credentials: confirms the Public Monitoring credentials are set.
- Connectivity: confirms the credentials are valid and the hosted Public Monitoring service is reachable.
Use these checks to confirm the integration is healthy after setup, and to diagnose it later if incidents stop being retrieved.
Showing and hiding the module
Once Public Monitoring is set up, you can hide the module from your workspace using the Deactivate Public Monitoring option in the product. While the module is hidden, incident synchronization continues in the background so no data is lost, but the module is removed from your workspace and Public Monitoring notifications are paused. You can show the module again at any time.
Network requirements
Public Monitoring requires your instance to make outbound HTTPS (port 443) requests to the following domains. These must be allowlisted in your firewall and, if applicable, your HTTP proxy. See Network requirements for the general self-hosted network model.
| Protocol | Port | Source | Destination | Description |
|---|---|---|---|---|
| TCP | 443 | All K8S nodes | enterprise.gitguardian.com | GitGuardian Public Monitoring API |
| TCP | 443 | All K8S nodes | gitguardian.auth0.com | Authentication |
| TCP | 443 | All K8S nodes | gg-gpm-incidents-prod.s3.amazonaws.com | Retrieval of public secret incidents |
