Version	Release Date
2025.4.0	April 25, 2025
2025.4.1	April 30, 2025

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.25	1.31
PostgreSQL	15	16
Redis	6
helm	3.13	Latest
ggscout	0.16.4	0.16.4 is the only supported version

⚠️ Please install the PostgreSQL pgvector extension to enable vector similarity search. This is essential for upcoming features leveraging our internal machine learning engine. Follow the installation instructions to ensure compatibility.

Helm & Upgrade Considerations​

⚠️ Important: This is a required release and cannot be skipped.

To ensure compatibility, please review Helm values updates from the previous version.

Air gap deployment? We've added new images in this release. Find all image and tag names on the Air Gap Install page.

Get full control of your Non-Human Identities​

We're proud to introduce our brand new NHI Governance product! This solution is designed to help you manage and secure your Non-Human Identities (NHIs) and related secrets.

As organizations face exponential growth in machine identities, NHI Governance delivers a comprehensive observability and lifecycle management across all your environments. Integrating with leading secrets managers and other sources from your infrastructure, it centralizes inventory, helps you assess your posture, and enforces security policies. The solution includes:

• Deep contextual insights, mapping relationships between secrets, their consumers, and resources, drastically reducing incident response times.
• Advanced analytics helps you identify risks like overprivileged NHIs and track hygiene metrics.
• Policy enforcement aligns your posture with standards such as the OWASP NHI Top 10.

NHI Governance empowers you to regain control over your NHIs and tied secrets, reduce risk, accelerate compliance tasks, and improve hygiene by addressing orphaned, untracked, or overprivileged credentials.

Ready to start your journey towards safer secrets management? Request access to GitGuardian NHI Governance by contacting your sales representative.

Learn more:

• Product Overview
• Documentation
• Blog Post

Prioritize faster with Secrets Analyzer​

We're excited to announce Secrets Analyzer, a new enhancement to our secrets detection capabilities.

Secrets Analyzer automatically gathers additional context for detected secrets, including their associated scopes, permissions, ownership, and relevant perimeter information where available.

This added intelligence helps security teams:

• Evaluate the potential impact of a secret incident more accurately.
• Prioritize remediation efforts based on risk level.
• Streamline the overall incident response process.

For details on how each analyzer works, including metadata collected and validation calls:

• Explore the Secret Analyzers documentation.
• View the full list of Available Analyzers.
• See a specific example for the Jira Token Secret Analyzer.

Improve incident remediation with custom tags​

Take control of incident management with custom tags. This feature allows you to categorize, filter, and search incidents using customized labels, offering greater flexibility in tracking and prioritizing incidents, and improving remediation workflows.

For developers, you can interact with custom tags via the API. For more information, visit the API documentation.

For more details on how to use custom tags within the GitGuardian platform, check out our detailed guide.

Email notifications enhancement​

You now have two options for receiving incident email notifications: "All incidents" (default) or "Only incidents involving yourself (based on your Git commit email)", learn more about email preferences.

Log collector for Self-Hosted​

Our self-hosted deployments now include a seamless log collection system, leveraging Loki, MinIO, and Fluent Bit under the hood. This enhancement ensures that relevant logs are efficiently gathered and stored, supporting faster troubleshooting and support—without requiring any manual setup from users.

This log collection system is now enabled by default for all installation types (Helm or KOTS).
Learn more about the log collector.

---

Secrets Detection Engine (v2.135)​

Improved accuracy and broader coverage in this latest release:

New Detectors

• Azure Logic App Shared Access Signature – New detector for Azure Logic App Shared Access Signature.
• Multiple new detectors have been added for Artifactory:
  • Artifactory Reference Token
  • Artifactory Reference Token With Host
  • Artifactory Master Key
  • Artifactory Basic Auth Credentials

Detector Improvements

• Snowflake Credentials – The Snowpark API credentials detector has been enhanced to identify more patterns.
• IBM Cloud Key – We reduced false positives in the IBM Platform API key detector.
• PlanetScale Database Password - Expanded detection to cover more host names for the Planetscale database password detector.
• Artifactory Token With Host - Improved precision for host names.
• LINE Messaging OAuth2 – Removed false positives from the LINE Messaging OAuth2 detector.
• OpenAI API Key – Fixed a bug in the analyzer for OpenAI API Key that prevented it from reporting threads:* scopes.

Detector changes

• FCM API Key – Removed FCM API Key checker since its API was removed.

Miscellaneous

• Add User Agent GitGuardian in HTTPClient class used by analyzers.

Enhancements​

• Incidents: Added a new filter to improve incident categorization based on the presence or absence of Jira Data Center tickets.
• Custom Tags: Users can now create custom tags directly from search queries in the dashboard.
• Custom webhook: Add the team name and webhook name to the custom webhook payload for incidents and occurrences. Learn more.
• Jira Configuration: Introduced a new layout for the Jira Configuration form to enhance user experience and streamline configuration tasks.
• Navigation Improvements:
  • Added persistent section state to remember your navigation preferences and updated browser tab titles for better identification when managing multiple tabs.
  • Added a "Skip to Main Content" button for better accessibility. When using keyboard navigation, pressing the Tab key reveals the button, which allows users to bypass navigation menus and jump directly to the main content area.
• Invitation: Added GET /v1/invitations/{invitation_id} endpoint to retrieve invitation details through the Public API.
• Self-Hosted:
  • Email Configuration: Improved error messages to provide clearer guidance when setting up email configurations.
  • Troubleshooting: Enhanced debug capabilities by adding network diagnostic tools (netcat, openssl) to the debug image. Learn more.
  • Helm:
    • Extended the readiness probe timeout on public-api to enhance stability and prevent premature failures.
    • Resolved an issue where the host was not specified in the health ingress configuration.
    • Added global.compatibility.openshift.adaptSecurityContext configuration to support OpenShift's restricted-v2 Security Context Constraints (SCC). Values include auto (default), force, and disabled for flexible security context adaptation. Learn more.
    • Added default support-bundle Role and optional ClusterRole creation (configurable via replicated.supportBundle.rbac.clusterRole.create).
    • The PostgreSQL pgvector extension is now required by default (postgresql.plugins.pgvector.enabled). Please follow the installation instructions to enable vector similarity search capabilities for upcoming machine learning features.
  • Ingress:
    • Improved response times for issue occurrence queries through optimized request routing. Particularly useful when autoscaling webapp-public_api.
    • Standardized health check endpoint routing by removing the wildcard host configuration from gim-ingress-health and consolidating /api/v1/health under the main API hostname.

Fixes​

• Jira Cloud Issue Tracking Integration: Fixed an issue where Jira project keys were incorrectly changed during synchronization.
• GitLab Integration:
  • Fixed an issue where multiple emails were sent for failures in multiple group hooks on the same GitLab instance, ensuring only one email is sent per instance.
  • We improved the process for read-only token installations by automatically detecting and updating the webhook ID if the webhook was created manually.
  • Resolved an issue where system hook checks returned a 403 forbidden error when using a read-only token.
  • Fixed unnecessary scans triggered by webhooks related to unmonitored repositories.
• Incidents: Fixed a bug that could cause unnecessary data refresh on the incidents list when switching browser tabs.
• Self-Hosted:
  • Licensing: Updated the notification message for license expiration on self-hosted environments to provide clearer guidance.
  • Security: Added Content Security Policy (CSP) headers to HTTP responses to strengthen browser security controls.

---

Hotfixes​

2025.4.1​

  Release Date: April 30, 2025

Fixes​

• Helm: Disabled Support Bundle Role creation by default to accommodate customers with high security requirements.

  Release Date: March 20, 2025

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.25	1.31
PostgreSQL	15	16
Redis	6
helm	3.13	Latest
ggscout	0.16.0	0.16.0 is the only supported version

⚠️ Please install the PostgreSQL pgvector extension to enable vector similarity search. This is essential for upcoming features leveraging our internal machine learning engine. Follow the installation instructions to ensure compatibility.

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version.

Air gap deployment? We’ve updated the path and names of our images in this release. Follow the upgrade instructions to update your tooling for downloading and uploading GitGuardian images to your private registry. Find all image and tag names on the Air Gap Install page.

Explore and prioritize your Generic Incidents​

We are excited to unveil the "Generic Secret Enricher V1", a machine learning model designed to enhance our capabilities in generic secret detection. This innovative model analyzes the entire context of a document, identifying the company and category associated with a secret, thereby providing meaningful insights to help users understand the origin and type of a discovered secret.

New Features​

• Contextual Analysis: Upon detection of a generic secret, our platform analyzes the full document context to determine the associated provider or category of a secret.

• Efficient Classification: This feature reduces the need for manual classification, enabling users to quickly comprehend the source and nature of a discovered generic secret.

• New Filters: We've introduced three new filters - Provider, Category, Family - to help identify critical generic incidents. To use these, filter your incidents by the "Generic" type, then apply a combination of these filters.

Goals​

Our long-term goal is to provide you with actionable insights, prioritize their generic incidents, and improve their remediation efforts.

Usage​

To use the new filters, simply filter your incidents by the "Generic" type, then apply a combination of the Provider, Category, and Family filters. This will help you identify the most significant or critical generic incidents, such as those classified under "Data Storage" or linked to the provider "Postgresql".

Leverage insights from your Secrets Managers​

GitGuardian now integrates with AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, Google Secret Manager, Delinea, and Akeyless through ggscout, letting you sync secret incidents with your Secrets Managers—without exposing sensitive data.

What’s in it for you?

• Prioritize Faster – Instantly see which secrets are already vaulted and focus on real risks.
• Remediate Quicker – Vault unprotected secrets in a click and speed up fixes.
• Streamline Workflows – Leverage vaulted secrets insights directly in GitGuardian.
• Improve Secrets Hygiene – Spot duplicate, weak, or mismanaged secrets with ggscout.
• Simplify Vault Consolidation – Track migrations, filter secrets, and purge outdated ones effortlessly.

---

Secrets Detection Engine (v2.133)​

Bringing enhanced accuracy and broader coverage:

• New Detectors
  • OpenAI Project API Key (v2) – Added support for detecting the new format of OpenAI project API keys.
  • OpenAI Admin API Key – New detection capability for OpenAI admin API keys.
  • Netlify Token (v2) – Introduced detection for the latest version of Netlify tokens.
  • 1Password Service Account Token – New detector added to identify 1Password service account tokens.
  • DeepSeek API Key – Now detecting DeepSeek API keys.
• Improved Detection
  • OpenAI Service Account – Expanded pattern coverage for better identification.
  • Rails Master Key – Updated detection rules to minimize false positives.
  • GitHub Tokens – Improved recall and validation for GitHub authentication tokens.
  • Groq API Key – Enhanced detection rules for greater accuracy.
  • Artifactory Token – New checker added to improve detection effectiveness.
  • Generic Passwords – Excluded secrets containing ***** as they are likely false positives.
  • Dropbox Key – Detector group split into Dropbox Key and Dropbox Access Token for improved granularity.
  • FCM API Key – Validity check is no longer available since the API has been removed. While we can no longer retrieve the validity status for FCM secrets, we still detect the keys.

Enhancements​

• Jira Issue Tracking Integration:
  • Added Incident ID as an optional variable in Jira ticket templates for improved customization.
  • Enabled instant ticket creation in Jira without requiring a predefined template.
• ggscout: Additional improvements to the integration of ggscout with self-hosted. Learn more.
  • Ensured Vault configurations are reachable via the preflight check for Helm and KOTS.
  • Hardened Helm chart (custom CA support, optional GitGuardian hostname).
  • Used Replicated Proxy to pull the ggscout image.
  • Enabled support for embedded cluster deployment (HashiCorp Vault only).
  • Included ggscout logs in the support bundle.
• Self-Hosted:
  • Public API: Added ability to customize maximum page size for the Public API pagination. More info here.
  • Embedded cluster: Machine learning is now activated by default for embedded cluster installations.
  • License: GitGuardian will now automatically synchronize license information for non-air-gap environments, eliminating the need for manual license syncs after installation or upgrades.
  • Helm: Added support for nodeSelector in Helm jobs to enhance node scheduling flexibility.

Fixes​

• Jira Cloud Issue Tracking Integration: Resolved an issue where integration entered an invalid state after being uninstalled.
• Microsoft Teams Alerts for Security Incidents: Resolved an issue where the wrong team was displayed during configuration.
• Self-Hosted:
  • Machine Learning: Added support for using custom security contexts, allowing to configure security settings for the machine learning pods.
  • Preflights: Fixed an issue with Redis TLS that could cause connection errors.

  Release Date: February 20, 2025

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.25	1.30
PostgreSQL	15	16
Redis	6	7
helm	3.13	Latest

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version.

Air gap deployment? Find all the images and tag names in the air gap install page.

Search Incidents by Secret Value​

GitGuardian allows you to monitor secret leaks across thousands of your repositories and over 30 different types of sources. It is reassuring to know that this critical secret, which provides access to your corporate LDAP, has not been detected anywhere.

Bitbucket Cloud Scanning​

Secure your Bitbucket Cloud repositories with secrets detection powered by GitGuardian.

• Detect exposed credentials and secrets in real-time.
• Gain visibility into security incidents directly in your dashboard.
  Learn more

Custom Tags Early Access​

Improve incident organization and tracking with Custom Tags, allowing users to filter, sort, and categorize incidents more effectively. For now, custom tag management (CRUD) and tag assignments to incidents can only be done via the API (API documentation), with UI support coming soon.

To activate this feature, enable custom_tags_enabled in the Preferences page.

Autoscaling​

HPA now supports web applications (e.g., webapp-public_api), allowing automatic scaling based on demand for improved performance and resource efficiency. Learn more on the autoscaling page.

---

Secrets Detection Engine (v2.131)​

Bringing enhanced accuracy and broader coverage:

• New Detectors
  • Artifactory Token With Host
  • HubSpot Private App Token
  • Microsoft Azure Storage Connection String
  • Hashicorp Vault AppRole Authentication
• Improved Detection for GitHub Tokens
  • Enhanced validation for GitHub Enterprise Token
  • Refined rules for various GitHub authentication tokens:
    • OAuth Access Token
    • Personal Access Token
    • Server-to-Server Token
    • GitHub Token
    • User-to-Server Token

Enhancements​

• Scan Only Addition Lines in Commits: Now, when using ggshield or our check runs integration, we only scan for added lines in commits. Developers will no longer be blocked while remediating incidents.
• Jira Issue Tracking Integration: Added support for "Numbers (or float)" and "Group Pickers (single group)" custom fields in Jira templates, allowing more customization in notifications and issue tracking.
• Enhanced Email Incident Alerting Controls for Members: You can now manage email notification settings more effectively with an option that allows updates through the API, and customize account-level defaults, ensuring a more tailored communication experience for all members. Learn more

Fixes​

• Sources:
  • Azure Repos Integration: Fixed an issue where organization deletions were not properly synced when using ADO installations in Organization-mode.
  • GitLab Integration: Resolved an issue where GitLab installations were incorrectly revoked due to temporary plan downgrades or admin status changes.
• Users & Teams:
  • Incidents: Resolved an issue where restricted users could not view the Vulnerable Sources block.
  • Users: Resolved an issue where user deletion was prevented due to the presence of saved views associated with the user.
  • Teams Management: Resolved an issue where action menus were not displayed in the teammates table for non-admin users in certain cases.
• Alerting:
  • Confluence Cloud Integration: Fixed an issue where some Confluence Cloud events without a spaceKey were incorrectly ignored.
  • PagerDuty Alerts for Security Incidents: Fixed an issue where the integration was not sending alerts for real-time incidents.
  • Email Notifications: Fixed an issue where emails for ignored and valid incidents were sent to all teams a user belongs to, instead of only the teams managing the affected repository.
• Self-Hosted:
  • Helm: Fixed an issue where connecting to Redis Sentinel failed when using a password with special characters.
  • Kots: Restore the left navigation menu in the KOTS admin console for embedded cluster installations.

Version	Release Date
2025.1.0	January 20, 2025
2025.1.1	January 23, 20255

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Component	Minimum Version	Recommended Version
KOTS	1.117.3	Latest
Kubernetes	1.25	1.30
PostgreSQL	15	16
Redis	6	7
helm	3.13	Latest

Helm & Upgrade Considerations​

⚠️ Important: This is a required release and cannot be skipped.

To ensure compatibility, please review Helm values updates from the previous version.

Air gap deployment? Find all the images and tag names in the air gap install page.

Upgrade Considerations: This release includes a background migration that may take up to 1 hour post-upgrade. It improves query execution speed and search performance. If upgrading from an older version, multiple upgrades may trigger a retry message—wait 1 hour before retrying.

Database Deprecation Notice: PostgreSQL 13 & 14 are no longer supported. Learn why upgrading to PostgreSQL 16 is recommended in our engineering blog.

Microsoft Teams Security Alerts​

Never miss a critical security event with real-time GitGuardian alerts in Microsoft Teams.

• Instant notifications when security incidents occur.
• Direct links to investigate issues inside GitGuardian.
  Learn more

Jira Auto-Tracking for Security Incidents​

Streamline incident response with Jira Data Center integration.

• Auto-create Jira issues when new incidents are detected.
• Sync custom fields for better tracking.
• Auto-resolve incidents when Jira issues are closed.
  Learn more

False Positive Remover v1​

Our first internal machine learning model halves false positives, ensuring data security and privacy without third-party dependencies. This in-house capability is now available for Self-Hosted. More information is available in the documentation.

Slack Secret Scanning​

Slack integration is now supported for scanning the full history of your public and private Slack channels to detect leaked secrets.

Remediation tracking​

Enhanced the secrets remediation workflow with precise location details for code fixes and real-time tracking of remediation progress. Learn more here.

⚠️ You can adjust the scan rate limit for the file tracking engine via the scan_after_push_force_rate_limit preference on the Preferences page. Historical scans are recommended to ensure incidents requiring fixes are available in the dashboard.

User management with SCIM​

SCIM integration now supports automatic user deprovisioning in GitGuardian when users are removed from your Identity Provider (IdP). Provisioning for users and teams will be included in a future update. Setup details are available in our documentation.

---

Secrets Detection Engine (v2.129)​

Bringing enhanced accuracy and broader coverage:

• New Detectors
  • GitLab OAuth Application Token
  • Jenkins API Token
  • chpasswd Username Password
  • Nessus Agent Key
  • Statsig Server Secret Key
• Improved Detection for Sensitive Credentials
  • Enhanced identification of Base64 Generic High Entropy Secret
  • Improved detection of GitGuardian Test Token Checked
  • Refined rules for MSSQL Credentials
  • Expanded coverage for Zendesk Token
  • Improved handling of FTP Credentials Assignment

Enhancements​

• Navigation: The menu has been redesigned with a collapsible left sidebar for a cleaner, more organized experience.
• Jira Data Center integration: Added support for the "User Picker (single user)" custom field in Jira templates. More information is available here.
• GitHub integration:
  • Improved handling of real-time events to retrieve more than 100 commits when necessary, ensuring complete coverage.
  • Enhanced processing of large patches by making additional API calls to retrieve missing files, up to the policy__maximum_scan_size limit defined in the Preferences page.
• Commit length configuration: Admins can configure the maximum total length of commits to scan, with larger commits truncated. This can be set via the repo_scan_max_commit_length preference on the Preferences page.

Self-Hosted​

• Helm: The ReplicatedSDK image is now pulled from the Replicated registry instead of Docker Hub. For airgap installations, ensure you update your automation processes for pulling and pushing images to your private registry. For more information, refer to the Airgap Installation page.
• Installation and upgrade: Improved error messages for partially initialized databases, providing clear instructions to check logs and ensure the PostgreSQL database is empty before retrying.
• Admin Area: Introduced a Periodic Tasks page to adjust schedules and fine-tune periodic task execution.
• Queues: Merged the secrets_checks queue with the background validity checks queue to optimize performance.

Fixes​

• Secrets:
  • Check runs: Updated messages to note flagged secrets lack commit references and remain compromised once leaked.
  • Validity check: Fixed an issue where the tooltip incorrectly indicated a token was valid for all endpoints when it was valid for only one.
• Sources:
  • GitLab: Enable viewing of more than 50,000 GitLab projects in the integration settings.
• Alerting:
  • Jira issue tracking: Fixed an issue where line feeds (\n) were not properly translated to hardBreak nodes, ensuring correct spacing in Jira tickets.
• Self-Hosted:
  • Admin area: Corrected sorting and filters on the Worker Tasks page for improved usability.

---

Hotfixes​

2025.1.1​

  Release Date: January 23, 2025

Fixes​

• Self-Hosted:
  • Embedded cluster installation:
    • Fix an issue where the GitGuardian dashboard returns a 404 error. Note this fix does not apply to legacy embedded clusters using Kurl.
    • Resolved the inability to deploy an embedded cluster with a custom CA.
  • Helm:
    • Fixed a 404 error on the /metrics endpoint for fetching GitGuardian applicative metrics on Webapp pods and Celery workers.
    • Fixed Replicated RBAC resources being created despite rbac.enabled: false in Helm values, causing issues in RBAC-restricted environments.