DockerHub

Limited availability

DockerHub monitoring is currently available to selected workspaces. Contact your Customer Success Management team to request access.

GitGuardian Public Monitoring scans public DockerHub container images to detect secrets exposed inside them. Secrets frequently end up baked into image layers - in build artifacts, configuration files, or environment data - where they remain accessible to anyone who pulls the image.

What we scan

GitGuardian analyzes the layers of public DockerHub images - the filesystem layers that make up an image - and detects secrets in their content.

Scan model

DockerHub monitoring works in two steps:

1. Initial scan. When DockerHub monitoring is set up for your workspace, GitGuardian matches all the public images it has collected so far against your perimeter.
2. Continuous monitoring. After that, newly published public images are matched against your perimeter every day. Exposures published after the initial scan appear as new incidents, usually within a day of being collected.

Attachment reasons

A secret found on DockerHub is attached to your company through your perimeter when it matches one of:

• Secret grasper - a secret grasper from your perimeter is found in the image content. This is the most common reason.
• Domain in secret value - a domain from your perimeter appears inside the secret value itself.
• Domain in owner profile - the DockerHub account that published the image has a domain from your perimeter in its public profile (for example, in the account's public email). The match is made on the published account's metadata, so the publisher does not need to be one of your monitored developers. In the dashboard, these incidents appear under the By dev from perimeter attachment reason.

Incident context

DockerHub incidents differ from GitHub incidents in the context they provide. Instead of a commit author and commit, you see:

• the image owner account (user or organization),
• the image and repository,
• the layer the secret was found in.

Occurrence date

For findings dated January 2025 onward, the occurrence date is precise - it reflects when the secret was actually exposed on DockerHub.

For older findings, treat the date with caution: it may reflect GitGuardian's historical backfill rather than the original exposure.

Limitations

• No presence checks. GitGuardian does not yet verify whether a secret is still publicly exposed on DockerHub, so these findings carry an Unknown presence status rather than a checked one.
• Large file contents are skipped. File contents larger than ~10 MB within an image are excluded, so a fraction of image content is not scanned.
• Large image layers are skipped. Very large image layers are not downloaded, so secrets inside them are not detected.