Version	Release Date
2025.7.0	July 25, 2025
2025.7.1	August 8, 2025

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.28 ⚠️	1.32
PostgreSQL	15	16
Redis	6	7
ggscout	0.16.6	Latest

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

⚠️ Important: This is a required release and cannot be skipped.

Historical Scanning now available for Jira and Confluence Data Center​

We’re excited to announce a significant enhancement to our secret detection capabilities for both Jira and Confluence Data Center: historical scanning is now available!

What's new?

Previously, our integrations would surface hardcoded secrets in real-time, alerting you to newly introduced risks as soon as they appeared. With this update, we’re extending our detection to include secrets that were leaked in the past—not just those introduced going forward.

Why does this matter?

Once a secret is leaked, it should always be considered compromised, regardless of when the leak occurred. By surfacing historical secrets, you can now:

• Identify and remediate old, forgotten leaks that may still pose a security risk.
• Reach a comprehensive security posture by ensuring that no secrets—past or present—slip through the cracks.
• Take proactive action to rotate or revoke secrets that may have been exposed long ago.

Check out our documentation to enable historical scanning now:

• Confluence Data Center
• Jira Data Center

Automatically Ignore Invalid Incidents with New Playbook​

We’re excited to announce a powerful enhancement to your incident management experience, designed to help you focus on what matters: we are introducing a new playbook: Automatically Ignore Invalid Incidents.

What's new?

This new playbook will automatically ignore incidents where the detected secret has been confirmed invalid and revoked, even for those that have never been valid. With this new capability, your team can immediately focus on genuine, actionable threats without being distracted by unnecessary noise from already-resolved issues.

Why This Matters?

By automatically clearing these known invalid incidents, you'll save valuable time, reduce alert fatigue, and maintain a clear focus on critical security issues that require your attention.

Important Note

This playbook is designed for incidents from standard detectors and will not impact those related to detectors with a custom host.

You Stay in Control

The playbook will be enabled by default, but you can opt out at any time if it doesn’t fit your needs. All incidents will remain accessible in your workspace for review.

Documentation

---

Secrets Detection Engine (v2.143)​

New Detectors

• GitLab Incoming Mail Token – Detects tokens used for GitLab incoming mail.
• Coze Personal Access Token – Detects personal access tokens for Coze services.
• Tavus API Key – Recognizes API keys for Tavus services.
• Heroku Platform Key – Detects prefixed variants of Heroku Platform Keys.
• SSH Credentials – New detector ssh_password_with_port allows matching SSH passwords with ports.
• Tableau Cloud PAT – Detects personal access tokens for Tableau Cloud.
• Notion Integration Token v2 – Detects the new Notion token format.
• AI71 API Key – Detects API keys for AI71 services.
• AMP API Token – Recognizes API tokens for AMP services.
• Kubernetes User Certificate with Port – Extracts port numbers for Kubernetes user certificates.
• NVIDIA API Key – Detects API keys for NVIDIA services.
• Alchemy API Key v2 – Identifies API keys for Alchemy services.
• OpenRouter API Key – Detects API keys for OpenRouter services.
• Duffel API Key – Recognizes API keys for Duffel services.
• Apify Token – Captures tokens for Apify services.
• Jina API Key – Detects API keys for Jina services.
• Deno Account Token – Identifies tokens for Deno accounts.
• Segment Workspace Key v2 – Detects workspace keys for Segment services.
• Resend API Key – Recognizes API keys for Resend services.
• VKontakte Access Token – Detects access tokens for VKontakte services.
• Fireworks AI API Key – Captures API keys for Fireworks AI services.

New Checkers These checkers are implemented to verify the detected secrets, adding another layer of security and ensuring their validity and correct application:

• Coze Personal Access Token
• Tavus API Key
• Heroku Platform Key
• Tableau Cloud PAT
• Notion Integration Token v2
• Salesforce OAuth2
• AI71 API Key
• AMP API Token
• Kubernetes User Certificate with Port
• Alchemy API Key v2
• OpenRouter API Key
• Duffel API Key
• Apify Token
• Jina API Key
• Deno Account Token
• Resend API Key
• VKontakte Access Token
• Fireworks AI API Key

Detector Improvements

• Google OAuth2 Keys – Improved precision for Google OAuth2 detector and enhanced regex for better detection accuracy.
• Zendesk Token – ZendeskTokenAnalyzer has been rewritten in Rust for improved performance.
• Sendinblue Key – SendinblueSecretAnalyzer has been rewritten in Rust.
• Generic High Entropy Secret – No longer considers IDs in ServiceNow migration files as secrets and removed AWS ECR images that were misclassified as secrets.
• Algolia Keys – AlgoliaKeysSecretAnalyzer has been rewritten in Rust.
• Fastly Personal Token – FastlySecretAnalyzer has been rewritten in Rust.
• [Hugging Face User Access] – Migrated analyzer to Rust for improved performance.
• Kubernetes Docker Secret – Enhanced detection for kubernetes.io/dockercfg secrets with more precise regex for JWTs.
• MySQL Assignment – Restricted the maximum number of secrets per document to prevent combinatorial explosion.
• Sourcegraph Token – Updated regex for sourcegraph_access_token_v3 as per customer request.
• GitHub Access Token – GitHub classic analyzer has been rewritten in Rust for improved performance.
• HashiCorp Vault Token – Improved precision for HashiCorp Vault token detection.
• Confluent Keys – Updated checker for Confluent API keys.
• GitHub Fine-Grained PAT – Analyzer now handles archived repositories.
• Slack Tokens – SlackBot analyzer has been rewritten in Rust for improved performance and applies to Slackbot, Slack App, and Slack User tokens.
• DigitalOcean Spaces Token – Fixed checker for tokens that do not have permission to list buckets.
• Checkout Secret Key – Updated endpoint to avoid deprecated usage.
• Checkout Sandbox Secret Key – Enhanced pattern and updated endpoint for improved accuracy.
• Bunny.net API Key – Fixed checker for better validation.
• Dify API Key – Updated checker endpoint for enhanced detection.

Engine Enhancements

• All JWT detectors will now only catch signed JWTs, enhancing security.

Enhancements​

• Jira Data Center Integration: Enhanced Jira Data Center incident creation to include leaker email addresses for historical comments occurrences.
• Custom Tags API: Enhanced the custom tags filter in the public API to support filtering by key/value pairs in addition to IDs, improving search flexibility for better incident management. Learn more.
• Playbook: "Auto-resolve secrets incidents when valid secrets are revoked" playbook is officially activated for all accounts. Learn about Playbooks
• Custom remediation: Added dynamic links to custom remediation pages, providing users with seamless access to relevant documentation and revocation support.
• Public API: Custom Tags (custom_tags) query parameters have been documented as part of the API documentation.
• GitLab integration: Configuration of multiple GitLab integrations using both system hooks and group hooks simultaneously is now supported.

Fixes​

• Custom Tags: Fixed an issue where assigning tags to selected filtered issues was incorrectly applying tags to all issues instead of only the selected ones.
• Azure DevOps Integration: Improved token handling to prevent unnecessary revocation of Azure DevOps installations due to intermittent 401 errors.
• Email Notifications: Improved email delivery logic for Microsoft Teams integrations to prevent excessive notification sending during periodic scans.
• GitHub Integration: Fixed an issue where dangling GitHub installations were being unnecessarily checked when no installations were present.
• User Management: Ensure SCIM user provisioning matches emails case-insensitively to prevent duplicate or mismatched user entries.
• Incidents Management: Resolved a regression where secrets detected on deletion lines could reopen incidents. Deletion lines are no longer scanned for secrets, as per the expected "Scan only addition line" behavior.

---

Hotfixes​

2025.7.1​

  Release Date: August 8, 2025

Fixes​

• Embedded Cluster with Embedded Redis: Updated configuration to use bitnamilegacy/redis registry following Bitnami's registry changes.
• ML Secret Engine: Updated to version 20250806 fixing critical CVE-2025-54381.
• NHI Scout: Bumped to version 0.18.2.

Version	Release Date
2025.6.0	June 20, 2025

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.28 ⚠️	1.32
PostgreSQL	15	16
Redis	6	7
ggscout	0.16.6	Latest

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

Securely Access Secret Values via API with GitGuardian's New “Secrets” Endpoint​

GitGuardian is excited to announce a new API endpoint /v1/secrets/{secret_id}, allowing users to securely access secret values directly through our API.

This feature introduces several key benefits:

1. Enhanced Security Automation - Integrate secret remediation into existing security workflows and tools with secure API access to secret values.
2. Reduced Manual Intervention - Eliminate the need to manually copy secrets from the UI, saving time and reducing human error.
3. Comprehensive Security Controls - Multiple security layers (PAT permissions, workspace settings) ensure secrets are accessed only by authorized users.
4. Complete Secret Context - Receive both the secret value and detector information in a single API call for efficient remediation.

Read more in the documentation

Secrets Detection in Microsoft Teams​

We’re pleased to introduce hardcoded secret detection for Microsoft Teams!

What’s new?

Our platform now scans Microsoft Teams messages for hardcoded secrets—such as API keys, credentials, and tokens—across both new activity and historical content. This means you can instantly identify and remediate exposed secrets, whether they were just shared or left unnoticed in your Teams environment.

Why is this important?

Once a secret is leaked, it remains a security risk until addressed—regardless of when it was exposed. By providing both real-time and historical scanning, we offer:

• Comprehensive coverage: Instantly detect newly introduced secrets and uncover old leaks hiding in past conversations or shared files.
• Proactive risk management: Take swift action to rotate, revoke, or investigate secrets, minimizing the window of exposure.
• Complete peace of mind: Ensure your Teams environment is continuously monitored and secured against secret sprawl.

Secure your collaboration. Protect your business.

Simply connect your Microsoft Teams instance and let our enhanced detection engine do the rest. Our solution will automatically scan both ongoing and historical Teams content, surfacing any hardcoded secrets for prompt remediation.

Check out our documentation to start protecting your MS Teams communications!

Historical Scanning now available for Jira and Confluence Cloud sources.​

We’re excited to announce a significant enhancement to our secret detection capabilities for Jira and Confluence Cloud: historical scanning is now available!

What's new?

Previously, our integration would surface hardcoded secrets in real-time, alerting you to newly introduced risks as soon as they appeared. With this update, we’re extending our detection to include secrets that were leaked in the past—not just those introduced going forward.

Why does this matter?

Once a secret is leaked, it should always be considered compromised, regardless of when the leak occurred. By surfacing historical secrets, you can now:

• Identify and remediate old, forgotten leaks that may still pose a security risk.
• Reach a comprehensive security posture by ensuring that no secrets—past or present—slip through the cracks.
• Take proactive action to rotate or revoke secrets that may have been exposed long ago.

Check out our documentation to enable the feature now:

• Jira Cloud
• Confluence Cloud
• Scaling

Detect hardcoded secrets in your Container Registries​

We are excited to introduce Secret detection for Container Registries, including:

• Azure Container Registry
• Google Artifact Registry
• JFrog Container Registry
• DockerHub

Secrets often end up in container images due to common mistakes during development and image creation, mainly:

• Hardcoding Secrets in Code: Developers may directly embed sensitive credentials, such as API keys or passwords, into application code, which gets packaged into container images.
• Misconfigured Dockerfiles: Commands like ENV or RUN in Dockerfiles can inadvertently expose sensitive data during the build process.

By identifying and addressing hardcoded credentials early in the development pipeline, this feature significantly minimizes the risk of security breaches, helping you prevent the unintended exposure of sensitive information before it even reaches production.

Check out our Blog Post to learn more and our documentation to enable the feature now:

• Azure Container Registry
• Docker Hub
• Google Artifact Registry
• JFrog Container Registry
• Scaling

Export self-hosted GitGuardian logs to Splunk and more​

You can now forward GitGuardian application logs to external log aggregation systems including Splunk, Loki, Elasticsearch, Kafka, and Datadog.

This allows you to integrate GitGuardian's logs with your existing observability infrastructure for centralized monitoring and analysis.

Check out our documentation to configure custom pipelines and start exporting your logs!

---

Secrets Detection Engine (v2.140)​

New Detectors

• GitLab Feature Flags Client Token – Detects tokens used for managing feature flags in GitLab projects, crucial for controlling feature rollouts and ensuring smooth deployment processes.
• Laravel Encryption Key with Host – Detects Laravel encryption keys associated with a host.
• GitLab Feature Flags Client Token with Project ID – Identifies tokens and project IDs for GitLab feature management.
• Kubernetes JWT with Host – Detects JWTs used in Kubernetes environments.
• GitLab Trigger Token – Recognizes tokens for triggering GitLab pipelines.
• Brave Search API Key – Detects API keys for accessing Brave Search.
• GitLab Deploy Token – Identifies deploy tokens for managing GitLab project deployments.
• Firecrawl API Key – Detects API keys for Firecrawl services.
• Dify API Key – Detects API keys for Dify services.
• GitLab Runner Authentication Token – Captures authentication tokens for GitLab runners.
• Ubidots API Key – Detects API keys for Ubidots.
• Vapi API Key – Detects API keys for Vapi services.
• Llama Cloud API Key – Ensures detection of API keys for Llama Cloud.

New Checkers These checkers are implemented to verify the detected secrets, adding another layer of security and ensuring their validity and correct application:

• Laravel Encryption Key with Host
• GitLab Feature Flags Client Token with Project ID
• Kubernetes JWT with Host
• Brave Search API Key
• Firecrawl API Key
• Dify API Key
• GitLab Runner Authentication Token

Detector Improvements

• Ubidots Token – Now includes new secret prefixes and improved checker responses for tokens from disabled accounts.
• Azure Cosmos DB Credentials – Enhanced host pattern to improve recall and detection accuracy.
• GitLab Token – Refined pattern to minimize false positives.
• ODBC Connection String – Advanced detection precision for ODBC strings.
• AMQP Credentials – Detector Upgrade: Enhanced multimatch selection to reduce false positive combinations, vital for secure message queuing in distributed systems.
• Confluent Keys – Detector Upgrade: Improved multimatch selection for better accuracy and fewer false positives, essential for managing access to Kafka clusters.
• Generic High Entropy Secret – Detector Upgrade: Excludes secrets ending with '.certificate' from being reported, reducing noise by ignoring non-sensitive certificates.
• Artifactory Token – Analyzer Upgrade: Improved stability by preventing crashes when analyzing secrets with multiple scopes, key for managing and securing software artifacts.
• Microsoft Azure Storage Connection String – Checker Upgrade: Enhanced to accept additional fields, crucial for accessing and managing Azure storage resources securely.
• Microsoft Azure Storage Account Key – Detector Upgrade: Increased precision, reducing false positives, critical for safeguarding data in cloud storage.

Engine Enhancements

• Established a priority rule favoring the confluent_api_keys detector over amqp_assignment and amqp_assignment_attached_port detectors.
• Expanded detection pattern list for encrypted strings to increase precision.
• Enhanced AssignmentRegexMatcher for N prefixed strings in SQL, supporting Microsoft SQL Server.

Enhancements​

• Teams: Optimized the /teams API endpoint to reduce loading times for workspaces with large team structures.
• Self-Hosted:
  • Improved ML Secret Engine Docker image permissions to support running with custom user and group IDs for better Kubernetes security contexts.
  • Improved Docker image permissions to support running with custom user and group IDs for better Kubernetes security contexts.
  • Improved handling of failed index creation migrations to allow safe re-execution of database updates.
  • Added capability to specify constraint of only one worker per node in Kubernetes deployments to optimize resource allocation. Learn more about scaling.

Fixes​

• Emails: Resolved an issue where email alerts were being sent to inactive workspace members.
• Custom Tags: Resolved pagination issues in the custom_tags endpoint that were causing incorrect next page URLs.
• GitLab: Improve permission checking for GitLab group integrations to properly handle inherited permissions from parent groups.
• Severity rules: Corrected an issue preventing Self-Hosted customers from adding or editing custom severity rule sets.
• Secret analyzer: Improved behavior to ensure secret analyzer is properly disabled when validity checking is turned off.
• Self-Hosted Deployment on GCP and Azure: Fixed an issue with ACL limitations on GCP and Azure cloud platforms where Redis deployments disable the ACL command, causing pre-deployment checks for the FLUSHDB command to fail. The system now gracefully handles scenarios where ACL commands are unavailable.

Version	Release Date
2025.5.0	May 22, 2025

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.25	1.32
PostgreSQL	15	16
Redis	6	7
ggscout	0.16.6	Latest

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version.

FIPS: This release uses Chainguard images without FIPS-approved cryptographic modules. If you would like to use Chainguard images with FIPS, please contact our support team.

ServiceNow secret scanning​

ServiceNow is now supported for secrets detection and honeytoken detection, enabling automated tracking of security incidents. Learn more

Customize Your Incidents View for Enhanced Context Exploration​

With this new feature, users can create fully customized views of their incidents, displaying specific properties and exploring their security data in an entirely new way.

This customization capability offers two key advantages:

1. Leverage the Generic Secret Enricher model (read 2025.3 release page) - You can now explore and prioritize generic incidents more effectively by visualizing the AI-classified secret categories and providers
2. Harness extensive incident context - Access the rich contextual data we provide for each incident, which is essential for efficient prioritization efforts

Context is critical for effective remediation. CyberSecurity is fundamentally a data business, and by collecting and presenting the richest, most structured context possible, we enable you to filter, sort, and prioritize incidents effectively and make informed decisions.

Read more in the documentation

Automate User Onboarding & Offboarding with SCIM​

SCIM (System for Cross-domain Identity Management) integration now supports both automatic user provisioning and deprovisioning in GitGuardian. When users are added or removed from your Identity Provider (IdP)—such as Okta or Microsoft Entra ID—they are automatically created or deactivated in your GitGuardian workspace.

Now, all your developers can be automatically onboarded to GitGuardian and are ready to handle security incidents as soon as they are added to your IdP. This means you can fully automate the onboarding and offboarding of users, directly from your IdP, ensuring your entire development team is always prepared to respond to incidents.

Why is this important?

• Streamlined onboarding: New users are automatically provisioned in GitGuardian as soon as they are added to your IdP—no more manual invites or user creation.
• Automated offboarding: When a user is removed or deactivated in your IdP, their access to GitGuardian is automatically revoked, reducing security risks.
• Real-time synchronization: User changes in your IdP are reflected in GitGuardian almost instantly, ensuring your workspace always stays up to date.
• Improved compliance: Automated user lifecycle management helps you meet security and compliance requirements by ensuring only authorized users have access.
• Reduced manual work: Save time and reduce errors by eliminating manual user management tasks.

Note: Team provisioning via SCIM is not yet available, but is planned for a future update.

How to get started?

• SCIM is available for workspaces using Okta or Microsoft Entra ID as their IdP.
• To enable SCIM, go to your workspace Settings > Authentication and follow the setup instructions for your IdP.
• For detailed configuration steps and best practices, check out our product documentation.

NHI Policies improvements​

Identify quick wins and areas of improvement thanks to improved policy breach visibility and management, including the ability to:

• Filter breaches by type on the inventory page,
• View detailed analytics on NHI breaches over time,
• Benefit from Secret Reuse policy for better secret management and security across environments.

Want to discover more about NHI Governance? Check out our public materials:

• Product Overview
• Documentation
• Blog Post

---

Secrets Detection Engine (v2.138)​

This release brings major enhancements to the Secrets Detection Engine, with a strong focus on expanding coverage for Artifactory and Azure services. New detectors have been added for a wide range of secrets—including Perplexity AI, Azure Entra ID, Communication Services, App Configuration, and more—helping organizations better protect sensitive credentials across their software supply chain and cloud infrastructure.

Key improvements include:

• Expanded Azure Coverage: New detectors for Entra ID tokens, Communication Services, App Configuration, DevOps PATs, and SignalR, strengthening security for Azure environments.
• Broader Secret Detection: Added support for Perplexity AI, Anthropic admin keys, Laravel encryption keys, X AI API keys, and GitGuardian Platform Magic Links.
• Enhanced Accuracy: Upgrades to existing detectors (LDAP, JWT, Cloudinary, Auth0, Claude, Jira, SMB, ODBC, Octopus, and more) improve precision, recall, and reduce false positives.

For full details on new detectors and improvements, see the list below.

New Detectors

• Perplexity AI API Keys – Added a new detector for Perplexity AI API keys.
• Azure SignalR Connection String – Introduced a new detector for Azure SignalR Connection Strings.
• Azure Event Grid Access Key – Added new detectors for Azure Event Grid Access Keys and a New Checker for the azure_event_grid_access_key_with_host detector.
• Anthropic Admin Keys – Introduced a new detector and New Checker for Anthropic admin keys.
• GitGuardian Platform Magic Link – Added a new detector for GitGuardian Platform Magic Links.
• Azure Entra ID Tokens – Detects tokens used for authentication within Azure's identity management service, Entra ID.
• Azure Communication Services Connection Strings – Identifies connection strings for Azure's comprehensive communication platform.
• Azure DevOps Personal Access Token – Recognizes personal access tokens used to authenticate with Azure DevOps.
• Laravel Encryption Key – Detects encryption keys used in Laravel applications for data security.
• Azure App Configuration Connection String – Identifies connection strings for managing application settings in Azure.
• X AI API Keys – Detects API keys for accessing X AI's artificial intelligence services.

Detector Improvements

• LDAP Credentials – Checker Upgrade: Improved the LDAP checker to better distinguish between connection errors and invalid credentials. Updated ldap_credentials_assignment_with_dn to remove false positives.
• JSON Web Token – Detector Upgrade: The detector will now detect all JWTs regardless of their contents.
• Cloudinary API Keys – Detector Upgrade: Extended charset of cloudinary_api_key_config to improve recall.
• Auth0 Keys – Detector Upgrade: Improved recall of the detector to detect more domains.
• Claude API Key – Detector Upgrade: Refined regex for Claude API keys.
• Riot Games API Key – Checker Updated: Banlist checker will be deleted.
• LINE Notify Token – Checker Updated: Banlist checker as the service has been discontinued.
• Microsoft Azure Storage Connection String – Detector Upgrade: Improved regex precision for more accurate detection.
• ODBC Connection String – Detector Upgrade: Enhanced regex precision to better identify ODBC connection strings.
• Jira Token – Detector Upgrade: Corrected host regex to accurately match ports.
• SMB Credentials – Detector Upgrade: Now allows percent sign as a separator between username and password in host matches.
• Octopus API Key – Checker Upgrade: Updated to use the correct API endpoint, resolving issues with secret validity checks.

Enhancements​

• Emails: Included the number of incidents to both weekly digest and historical scan emails subject line
• Jira Data Center Issue Tracking Integration: Creating Jira tickets now only requires regular user permissions. Administrator privileges on the Jira Data Center site are only needed when setting up the two-way synchronization (Auto-resolve feature).
• Self-Hosted:
  • Ensured that the Redis FLUSHDB command is available for use before installing or upgrading GitGuardian. Learn more.
  • Added support for configuring proxy username and password using Kubernetes secrets. Learn more.
  • GitGuardian Chainguard images are now used by default and include a shell for troubleshooting and maintenance.
• Security: Implemented a Content Security Policy in response headers to better control which resources can be loaded, strengthening overall security.

Fixes​

• GitLab Integrations: Resolved a problem where system hook checks returned a 403 forbidden error when using a read-only token.
• Dashboard: Resolved an issue where a toast message displayed "unknown error" in certain situations.
• Historical Scan: Resolved an issue where scans of empty GitHub repositories were incorrectly marked as failed.
• API: Resolved an issue where deleted sources were incorrectly displayed as monitored.
• Self-Hosted:
  • Resolved an issue where deployment failed when using Kustomize.
  • Increased the readiness probe timeout for public-api to enhance stability and prevent failures.

  Release Date: February 20, 2025

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.25	1.30
PostgreSQL	15	16
Redis	6	7
helm	3.13	Latest

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

Search Incidents by Secret Value​

GitGuardian allows you to monitor secret leaks across thousands of your repositories and over 30 different types of sources. It is reassuring to know that this critical secret, which provides access to your corporate LDAP, has not been detected anywhere.

Bitbucket Cloud Scanning​

Secure your Bitbucket Cloud repositories with secrets detection powered by GitGuardian.

• Detect exposed credentials and secrets in real-time.
• Gain visibility into security incidents directly in your dashboard.
  Learn more

Custom Tags Early Access​

Improve incident organization and tracking with Custom Tags, allowing users to filter, sort, and categorize incidents more effectively. For now, custom tag management (CRUD) and tag assignments to incidents can only be done via the API (API documentation), with UI support coming soon.

To activate this feature, enable custom_tags_enabled in the Preferences page.

Autoscaling​

HPA now supports web applications (e.g., webapp-public_api), allowing automatic scaling based on demand for improved performance and resource efficiency. Learn more on the autoscaling page.

---

Secrets Detection Engine (v2.131)​

Bringing enhanced accuracy and broader coverage:

• New Detectors
  • Artifactory Token With Host
  • HubSpot Private App Token
  • Microsoft Azure Storage Connection String
  • Hashicorp Vault AppRole Authentication
• Improved Detection for GitHub Tokens
  • Enhanced validation for GitHub Enterprise Token
  • Refined rules for various GitHub authentication tokens:
    • OAuth Access Token
    • Personal Access Token
    • Server-to-Server Token
    • GitHub Token
    • User-to-Server Token

Enhancements​

• Scan Only Addition Lines in Commits: Now, when using ggshield or our check runs integration, we only scan for added lines in commits. Developers will no longer be blocked while remediating incidents.
• Jira Issue Tracking Integration: Added support for "Numbers (or float)" and "Group Pickers (single group)" custom fields in Jira templates, allowing more customization in notifications and issue tracking.
• Enhanced Email Incident Alerting Controls for Members: You can now manage email notification settings more effectively with an option that allows updates through the API, and customize account-level defaults, ensuring a more tailored communication experience for all members. Learn more

Fixes​

• Sources:
  • Azure Repos Integration: Fixed an issue where organization deletions were not properly synced when using ADO installations in Organization-mode.
  • GitLab Integration: Resolved an issue where GitLab installations were incorrectly revoked due to temporary plan downgrades or admin status changes.
• Users & Teams:
  • Incidents: Resolved an issue where restricted users could not view the Vulnerable Sources block.
  • Users: Resolved an issue where user deletion was prevented due to the presence of saved views associated with the user.
  • Teams Management: Resolved an issue where action menus were not displayed in the teammates table for non-admin users in certain cases.
• Alerting:
  • Confluence Cloud Integration: Fixed an issue where some Confluence Cloud events without a spaceKey were incorrectly ignored.
  • PagerDuty Alerts for Security Incidents: Fixed an issue where the integration was not sending alerts for real-time incidents.
  • Email Notifications: Fixed an issue where emails for ignored and valid incidents were sent to all teams a user belongs to, instead of only the teams managing the affected repository.
• Self-Hosted:
  • Helm: Fixed an issue where connecting to Redis Sentinel failed when using a password with special characters.
  • Kots: Restore the left navigation menu in the KOTS admin console for embedded cluster installations.

Version	Release Date
2025.1.0	January 20, 2025
2025.1.1	January 23, 20255

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.25	1.30
PostgreSQL	15	16
Redis	6	7
helm	3.13	Latest

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

⚠️ Important: This is a required release and cannot be skipped.

Microsoft Teams Security Alerts​

Never miss a critical security event with real-time GitGuardian alerts in Microsoft Teams.

• Instant notifications when security incidents occur.
• Direct links to investigate issues inside GitGuardian.
  Learn more

Jira Auto-Tracking for Security Incidents​

Streamline incident response with Jira Data Center integration.

• Auto-create Jira issues when new incidents are detected.
• Sync custom fields for better tracking.
• Auto-resolve incidents when Jira issues are closed.
  Learn more

False Positive Remover v1​

Our first internal machine learning model halves false positives, ensuring data security and privacy without third-party dependencies. This in-house capability is now available for Self-Hosted. More information is available in the documentation.

Slack Secret Scanning​

Slack integration is now supported for scanning the full history of your public and private Slack channels to detect leaked secrets.

Remediation tracking​

Enhanced the secrets remediation workflow with precise location details for code fixes and real-time tracking of remediation progress. Learn more here.

⚠️ You can adjust the scan rate limit for the file tracking engine via the scan_after_push_force_rate_limit preference on the Preferences page. Historical scans are recommended to ensure incidents requiring fixes are available in the dashboard.

User management with SCIM​

SCIM integration now supports automatic user deprovisioning in GitGuardian when users are removed from your Identity Provider (IdP). Provisioning for users and teams will be included in a future update. Setup details are available in our documentation.

---

Secrets Detection Engine (v2.129)​

Bringing enhanced accuracy and broader coverage:

• New Detectors
  • GitLab OAuth Application Token
  • Jenkins API Token
  • chpasswd Username Password
  • Nessus Agent Key
  • Statsig Server Secret Key
• Improved Detection for Sensitive Credentials
  • Enhanced identification of Base64 Generic High Entropy Secret
  • Improved detection of GitGuardian Test Token Checked
  • Refined rules for MSSQL Credentials
  • Expanded coverage for Zendesk Token
  • Improved handling of FTP Credentials Assignment

Enhancements​

• Navigation: The menu has been redesigned with a collapsible left sidebar for a cleaner, more organized experience.
• Jira Data Center integration: Added support for the "User Picker (single user)" custom field in Jira templates. More information is available here.
• GitHub integration:
  • Improved handling of real-time events to retrieve more than 100 commits when necessary, ensuring complete coverage.
  • Enhanced processing of large patches by making additional API calls to retrieve missing files, up to the policy__maximum_scan_size limit defined in the Preferences page.
• Commit length configuration: Admins can configure the maximum total length of commits to scan, with larger commits truncated. This can be set via the repo_scan_max_commit_length preference on the Preferences page.

Self-Hosted​

• Helm: The ReplicatedSDK image is now pulled from the Replicated registry instead of Docker Hub. For airgap installations, ensure you update your automation processes for pulling and pushing images to your private registry. For more information, refer to the Airgap Installation page.
• Installation and upgrade: Improved error messages for partially initialized databases, providing clear instructions to check logs and ensure the PostgreSQL database is empty before retrying.
• Admin Area: Introduced a Periodic Tasks page to adjust schedules and fine-tune periodic task execution.
• Queues: Merged the secrets_checks queue with the background validity checks queue to optimize performance.

Fixes​

• Secrets:
  • Check runs: Updated messages to note flagged secrets lack commit references and remain compromised once leaked.
  • Validity check: Fixed an issue where the tooltip incorrectly indicated a token was valid for all endpoints when it was valid for only one.
• Sources:
  • GitLab: Enable viewing of more than 50,000 GitLab projects in the integration settings.
• Alerting:
  • Jira issue tracking: Fixed an issue where line feeds (\n) were not properly translated to hardBreak nodes, ensuring correct spacing in Jira tickets.
• Self-Hosted:
  • Admin area: Corrected sorting and filters on the Worker Tasks page for improved usability.

---

Hotfixes​

2025.1.1​

  Release Date: January 23, 2025

Fixes​

• Self-Hosted:
  • Embedded cluster installation:
    • Fix an issue where the GitGuardian dashboard returns a 404 error. Note this fix does not apply to legacy embedded clusters using Kurl.
    • Resolved the inability to deploy an embedded cluster with a custom CA.
  • Helm:
    • Fixed a 404 error on the /metrics endpoint for fetching GitGuardian applicative metrics on Webapp pods and Celery workers.
    • Fixed Replicated RBAC resources being created despite rbac.enabled: false in Helm values, causing issues in RBAC-restricted environments.