5 posts tagged with "honeytoken"

  Release Date: November 12, 2026

Stealing secrets from developer machines is now an industry. TeamPCP opened the year with Trivy and LiteLLM, then reused what it stole to reach Mistral, Grafana and GitHub. It open-sourced its Mini Shai-Hulud worm in May, and copies followed: four campaigns in two weeks across npm, PyPI, Crates.io, Composer and GitHub, four more in June, and in August a single wave that hit 800 npm packages and 469 secret locations on each infected machine. The payload changes every month, but the shopping list does not: every credential on the machine, including the ~/.kube/config that opens your Kubernetes clusters.

Honeytoken catches the theft. It already plants a decoy AWS key on your endpoints. It now plants a Kubeconfig decoy as well, written into ~/.kube/config next to your real clusters and pointing to a cluster GitGuardian controls. A stealer takes it with the rest. The first call made with it raises an alert and names the machine it was taken from. Ships in ggshield 1.56 or later.

What does this mean for you?

• Indistinguishable from a real cluster: the file is exactly what kubectl writes, and secret scanners, including our own Kubeconfig detector, flag the token as live. Yet it opens no cluster and holds no permission.
• An alert on the first call: any request made with the token creates an event with the IP address, country, user agent and path, and fires your alerts by email, Slack, Microsoft Teams, ServiceNow or webhook.
• A named machine, not a hash: the Sources card tells you which laptop or runner the file was taken from, and who owns it.
• Safe for the owner: on a machine that already has a kubeconfig, the decoy never becomes the current context, so a developer's own kubectl cannot trip it.
• Nothing new to install: ggshield writes the file and leaves. Revoke the honeytoken and the next run removes it. Plant it alongside the AWS key decoy: each trigger tells you which file was read.

Why is this important?

A secret theft is silent. The malware reads a few files and sends them out. Nothing breaks, no service goes down, and the stolen keys keep working for their legitimate owners. Most victims learn about the breach when the attacker starts using the keys, often weeks later, and by then the keys have been tested and sorted. After the TeamPCP compromise of LiteLLM, Wiz saw stolen secrets validated within hours. The loot from that 40-minute window was only measured five months later: 153 GB and 2,488 organizations, many of which nobody can even notify.

A honeytoken is the strongest signal you can get of such a theft. The decoy has no legitimate use, so any call made with it means that someone took your secrets. It fires at the first step of the attack, when the attacker checks which stolen keys are valid, and before any real key is used against you. It does not depend on catching the malware itself, so it works against packages your EDR and your dependency scanner have never seen. And because GitGuardian knows where each decoy was planted, the alert comes with the name of the compromised machine, which is where your investigation starts.

Start trapping bad actors today!

Available on SaaS for workspaces with Endpoint Protection on a Growth or Enterprise plan. If your fleet already plants AWS key honeytokens, add one line to the job:

ggshield honeytoken plant --type kubeconfig

Requires ggshield 1.56 or later and the honeytokens:write scope. See Honeytoken types, Protect endpoints with Honeytokens and the ggshield honeytoken plant reference.

Enhancements​

• Public Monitoring: Filter public incidents by Source owner: the GitHub organization or user, or the Docker Hub namespace, that published the source.
• Public API:
  • Revoke a secret with POST /v1/secrets/{secret_id}/revoke. Pass provider credentials in the credentials body field to override the workspace defaults. The detector object of secret and incident responses lists which ones the revoker needs. Requires the secrets:write scope.
  • Filter GET /v1/check-runs by commit_sha, pull_request_number or source_id, in addition to incident_id, so you can find the check runs of a pull request even when its findings have no incident. Each check run now also returns its repository's full name and source id.
  • Public incidents now carry the agents analysis result, company_related_verdict (related, unclear, unrelated) and agents_stage, in the list, the detail and the CSV export, and both are filterable, so a SIEM or ticketing tool can reproduce your dashboard views. Available to workspaces with agents analysis.
• Team Sync: When team sync is on, the Teams page gains a Synced from filter on the provider teams come from, so you can tell synced teams from the ones created by hand.
• Authentication: Password logins are now locked out for six minutes after ten failed attempts for the same email and IP address. The login endpoint answers 429 with a Retry-After header, and a password_login_locked_out entry in the audit log records the IP address and the number of attempts.
• Perimeter: On an integration's perimeter, Select all N that match filters is now available at the root level, as on the Perimeter page, so you can monitor or unmonitor every source of an integration in one action.
• JFrog Container Registry Integration: Federated Docker repositories are now scanned alongside local ones. On existing installations, new federated repositories are not monitored by default, so you choose which ones to add.

Fixes​

• Public Monitoring: Fixed an issue where adding a custom tag to a filtered selection of public incidents with "select all" applied the tag to every public incident.
• NHI Governance: Fixed an issue where the ggscout configuration examples on the integration setup page for CyberArk Secrets Manager, GCP Secret Manager and Kubernetes used options ggscout does not read, so the configuration failed to load or silently ignored the key file.
• Historical scans: Fixed an issue where the queued scans of a large bulk were timed out after a week of waiting for a slot.
• SharePoint Online and OneDrive Integrations: The Organization.Read.All permission is no longer required on your Entra application. Without it, the installation is named after its tenant ID.

  Release Date: August 10, 2026

Credential stealers do not hunt around a developer machine, they go straight for the handful of files where developers keep their secrets.

Endpoint Protection already gives you a full inventory of the credentials sitting in those files, and it now adds intrusion detection to that same deployment: ggshield plants a decoy AWS credential exactly where the stealers look first. The decoy opens nothing, so nobody has a reason to touch it. The moment someone does, you get an alert that names the compromised endpoint.

What does this mean for you?

• A tripwire on the surface attackers hit first: stealers arrive through malicious packages, trojanized tools, and rogue browser extensions. Whichever way they get in, reading that credential file is their first move, and that move is now what exposes them.
• Alerts with no ambiguity: the decoy has no legitimate use, so any use of it is unauthorized by definition. There is no baseline to learn, no tuning, and no signature list to maintain.
• A last line of defense: if malware has already slipped past your EDR and other endpoint controls, using the decoy still gives it away.
• A named machine to investigate: each event carries the IP address, user agent, and timestamp, and resolves to a specific endpoint and its owner.
• Coverage you can measure: a new Honeytoken protection card in the Endpoints dashboard reports the share of your fleet that is protected and lists the endpoints that are not, so you can drive coverage to completion.
• No new agent to deploy: planting reuses the ggshield binary you already install for scanning and writes a file rather than running a resident process.

Why is this important?

Credentials on developer machines have been a blind spot for a long time. Repository scanning, CI checks, and collaboration tool monitoring only ever see secrets that leave the laptop, while the credentials that stay local are exactly the ones harvesting malware is built to collect. Endpoint Protection brought those credentials into your inventory. It now watches for the theft itself, at the moment it happens, on a surface where most organizations have no detection at all.

For developers, this is invisible. Planting only ever touches its own credential profile and leaves every other profile on the machine untouched.

Start securing your endpoint fleet now!

Honeytoken protection is available now for workspaces with Endpoint Protection on a Business or Enterprise plan. If you already run endpoint scanning, adding it means nothing more than one MDM job to update and one more scope on your service account token.

• Protect endpoints with Honeytokens for how planting works, how to verify it, and how to remove it
• Deploy ggshield at scale with a service account token for the token scopes and MDM job setup
• Monitor coverage for tracking coverage across your fleet
• ggshield honeytoken plant for the full command reference

Enhancements​

• Public API: Added the ability to create Personal Access Tokens (PATs) and Service Account Tokens (SATs) programmatically via the API, enabling automated token rotation workflows. Tokens created via the API must have a finite TTL.
• ggshield: Launched an Azure DevOps extension that lets admins add a ggshield secret scan job to every pipeline in their organization with a single pipeline decorator. See Azure Pipelines for details.
• Perimeter management: Automatic monitoring and automatic scan toggles are now available on Jira Cloud, Jira Data Center, Confluence Cloud, Confluence Data Center, and Microsoft Teams. New spaces, projects, and channels discovered on these sources can be picked up and scanned without adding them by hand, the same way the VCS integrations already work.

Fixes​

• Audit Logs: Scans triggered via a Personal Access Token now emit an audit log event.
• Incidents: Fixed a display error in the decoded claims panel of a JWT secret. Malformed timestamp or scope claims, and payloads that are not a JSON object, now fall back to the raw value instead of breaking the panel.
• Issue Tracking Integration: Fixed the "Edit issue" dialog closing unexpectedly.
• Notifications: Fixed an issue where the team name was not populated for notifiers when the workspace contained more than 100 teams.
• Access Management: Fixed an issue where deactivated members were incorrectly displayed in the grant access dialog.
• GitHub Checkruns integration: Fixed an issue where a disabled detector could still block pull requests.
• JFrog Artifactory Integration: Fixed an issue where the JFrog Container Registry reachability check did not route through ggbridge.
• GitLab Integration: Fixed an issue where GitLab sources appeared as monitored in the integration settings but were not reflected in the perimeter view.

  Release Date: June 30, 2026

The ServiceNow issue-tracking integration now covers Public Monitoring and Honeytoken events alongside Internal Monitoring, and brings the Smart Notifier filters to ServiceNow. You choose which incidents flow into ServiceNow and which events appear on their tickets, keeping your ticketing scoped to what matters.

What's new?

Event Group Selection: Choose whether ServiceNow creates tickets for Internal monitoring, Public monitoring, or Honeytoken events.

Public Monitoring Support: Route public monitoring incidents to ServiceNow, so secrets exposed on public sources are tracked in the same workflow as your internal incidents.

Honeytoken Support: Create ServiceNow tickets for honeytoken events, bringing decoy alerts into your remediation workflow.

Granular Event Subscription: Previously, you could not choose which events reached ServiceNow. The new Notify when section now lets you select them. The New incident detected event (always included) creates the ticket; the other events you select are posted as comments on that same ticket, keeping the full incident history in one place. For Internal and Public Monitoring, use filters and presets - by severity, risk score, validity, secret type, or tag - to refine the selection, or start from scratch.

Why is this important?

Security teams need ticketing scoped to their remediation work. Event group selection and granular subscription route only the incidents you care about into ServiceNow, cutting noise. Public Monitoring and Honeytoken support bring perimeter and decoy alerts into the same workflow as internal incidents.

Get Started Today!

Available for all workspaces. Existing ServiceNow integrations keep their current settings, and new configurations can enable the expanded event coverage.

Learn more about the ServiceNow integration | Configure honeytoken alerts

Enhancements​

• Sources health management — Confluence Cloud, Slack, Gerrit, and Microsoft SharePoint Online: GitGuardian now pauses real-time ingestion and historical scans on unreachable Confluence Cloud, Slack, Gerrit, and Microsoft SharePoint Online sources, auto-resumes them once health is restored, and surfaces an actionable recovery step. Rolling out to more integrations in upcoming releases. See the integration guides for Confluence Cloud, Slack, Gerrit, and Microsoft SharePoint Online.
• Incident Notifications: Incident notifications in Slack and Microsoft Teams now include the risk score and severity information.
• AWS Marketplace: Added support for a second AWS Marketplace seller account (GitGuardian Inc., US entity), enabling US customers to transact through the US listing while existing customers continue through the original French listing.
• Public API: Added a new API endpoint to retrieve the activity log of a secret incident, enabling automation and monitoring workflows. Learn more.

Fixes​

• Security: fixed an issue where a Service Account Token (SAT) could revoke itself through the public API (e.g. via ggshield auth logout), which could disable every deployment sharing that token. A SAT can now only be revoked from the dashboard or by another token holding the api_tokens:write scope; Personal Access Token self-revocation is unchanged. Learn more.
• Incident assignment: Assigning a secret incident now automatically grants the assignee the access they need. Previously, an assignee without access could receive the notification email but be unable to open the incident.
• Incident details: Fixed an issue where the incident detail view could display the wrong secret line when privacy mode was enabled, due to position misalignment caused by content obfuscation.
• Custom tags: Fixed an issue where members were unable to remove the last custom tag from an incident.
• Custom webhooks: Creating a webhook with an unreachable URL now shows a clear error message instead of failing with a generic server error.
• Playbooks: Fixed unexpected behavior with the auto-grant developer access playbook where access was not correctly applied in certain configurations.
• Activity logs: The auto-grant access playbook now records an entry in the related issue's activity log, consistent with other playbooks.
• JFrog Container Registry: Fixed an issue where only the first ~200 repositories were discovered, leaving the rest unmonitored and sometimes flagged as deleted. All repositories are now discovered.
• GitLab: Fixed a health check that could incorrectly mark a reachable GitLab instance as unavailable when its endpoint returned a 4xx response.

  Release Date: April 29, 2026

We're excited to announce a major enhancement to our Microsoft Teams integration that brings comprehensive notification coverage for all incident lifecycle events, honeytoken alerts, and public monitoring incidents. This unified notification framework provides complete visibility into your security posture directly in Microsoft Teams.

What's new?

Complete Incident Lifecycle Coverage: Previously, Microsoft Teams notifications only covered new incident detections and regression. Now you can receive notifications for every critical event including resolution, assignment, status changes, comments, access control, and sharing - giving you complete visibility into incident management workflows.

Public Monitoring Support: Public monitoring incidents can be sent directly to Microsoft Teams channels, enabling teams to receive perimeter security alerts alongside internal monitoring alerts.

Honeytoken Alerting: Microsoft Teams notifications now support honeytoken events, providing immediate alerts for honeytoken activity, previously only available via custom webhooks and email.

Flexible Configuration: Enhanced Microsoft Teams configuration allows teams to subscribe to specific event types per channel, providing granular control over notification preferences.

Why is this important?

Security teams need real-time visibility into all security events to respond quickly and effectively. This enhancement addresses key customer feedback about missing notification updates for incident resolution and status changes, while extending Microsoft Teams integration to public monitoring and honeytoken.

Get Started Today!

This enhancement is automatically available for all workspaces. Existing Microsoft Teams integrations will maintain their current notification settings, while new configurations can be set up with expanded event coverage.

Learn more about Microsoft Teams integration configuration | Configure honeytoken alerts

Enhancements​

• Public API: New Health Checks endpoints let you programmatically monitor the health of your integration instances (GitHub, GitLab, Slack, Jira, and more). List the latest health check across all instances, filter by integration type, status, or date, and retrieve the full health check history for a specific instance to power your own dashboards and alerting.
• Public API: You can now retrieve and filter archived sources.
  • Sources endpoint: now offer the provider_metadata.archived field (currently available for GitHub sources) and a provider_metadata_archived=true filter.
  • Incidents endpoint: now offer an only_on_provider_archived_sources=true filter to focus on incidents from archived sources and run bulk actions on the returned list.

  Release Date: October 25, 2025

We're excited to announce a major enhancement to our Slack integration that brings comprehensive notification coverage for all incident lifecycle events, honeytoken alerts, and public monitoring incidents. This unified notification framework provides complete visibility into your security posture directly in Slack.

What's new?

Complete Incident Lifecycle Coverage: Previously, Slack notifications only covered new incident detections and regression. Now you can receive notifications for every critical event including resolution, assignment, status changes, comments, access control, and sharing - giving you complete visibility into incident management workflows.

Public Monitoring Support: Public monitoring incidents can be sent directly to Slack channels, enabling teams to receive perimeter security alerts alongside internal monitoring alerts.

Honeytoken Alerting: Slack notifications now support honeytoken events, providing immediate alerts for honeytoken activity, previously only available via custom webhooks and email.

Flexible Configuration: Enhanced Slack webhook configuration allows teams to subscribe to specific event types per channel, providing granular control over notification preferences.

Why is this important?

Security teams need real-time visibility into all security events to respond quickly and effectively. This enhancement addresses key customer feedback about missing notification updates for incident resolution and status changes, while extending Slack integration to public monitoring and honeytoken.

Get Started Today!

This enhancement is automatically available for all workspaces. Existing Slack integrations will maintain their current notification settings, while new configurations can be set up with expanded event coverage.

Learn more about Slack integration configuration | Configure honeytoken alerts

Enhancements​

• GitGuardian Bridge: Extended support for GitGuardian Bridge to SaaS EU. Learn more about GG Bridge.
• Public API: Enabled editing of Custom Monitored Perimeter via Public API for all sources (except for custom sources).
• GitLab Integration: Improved performance of the GitLab source selection interface to prevent browser unresponsiveness when searching through large numbers of namespaces, groups, and repositories.

Fixes​

• Perimeter: Fixed an issue where the scan button was not visible for members who are not in the all incidents team.
• SSO: Fixed an issue preventing IDP configuration creation due to missing default SCIM team permissions.
• Sources:
  • Fixed tooltip displaying "unknown error" for failed scans when the actual reason was branch deletion.
  • Resolved JFrog Container Registry health check failure when the first registry contains no repositories.
• Incidents:
  • Fixed an issue where occurrences displayed incorrect commit and file information, ensuring accurate incident tracking data.
  • Fixed an issue where the "Requires code fixing" section failed to load in some condition.