Version	Release Date
2026.7.0	July 24, 2026

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

⚠️ Important: This is a required release and cannot be skipped.

Feature highlights​

• Public Monitoring on Self-Hosted — Public Monitoring is now available on self-hosted instances (license-gated). Monitor your public perimeter for secret leaks, and route public secret incidents through the full alerting and ticketing stack: custom webhook, Slack, and Microsoft Teams notifications, ServiceNow ticketing, plus email alerting filtered by public incident severity. Enable the optional celeryWorkers.public-monitoring worker to process the Public Monitoring queues. Learn more.
• Gerrit secret scanning — native Gerrit VCS source with full historical scanning, real-time detection via the webhook plugin, and read-replica support for cloning. Learn more.
• Smart Notifiers — filter alerts and tickets by incident criteria — define per-channel rules so an alert, ticket, or email is only created for the incidents that matter, filtering by severity, validity, secret type, or GitGuardian tag, across internal and public monitoring. Learn more.
• GitHub check runs — mitigate API rate limits — oversized pull requests are now scanned by cloning the repository branch instead of calling the GitHub API commit by commit, and check runs can skip merge commits, protecting your shared GitHub API rate limit. The check run size thresholds and rate-limit behavior are customizable from the admin area GitHub preferences. Learn more.
• Gateway API routing & autoscaling — route external traffic through the Kubernetes Gateway API instead of the legacy Ingress resource, and scale webapps with Kubernetes HPA or KEDA autoscaling. Learn more.

Secrets Detection Engine​

• v2.166 — 9 new detectors (Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, and five Azure services: Maps, Mixed Reality, Service Bus, Quantum, Bot Direct Line), 2 new checkers (Gemfury Deploy/Push Token, Gemfury Full Access Token), 3 detector improvements (LiteLLM API Key, GitLab runner authentication token, Artifactory Token With Host), 2 analyzer updates (Google Cloud Keys, GitLab Token).

Enhancements​

• Jira Notifier now exposes remediation guidance and detector-specific links as assignable fields in the ticket description template. Learn more.
• Custom Sources (BYOS) option to scan with validated detectors only. Learn more.
• Self-Hosted:
  • The daily analytics job can now write its Spark scratch data to a dedicated ephemeral volume instead of the node's local disk, preventing job failures from node ephemeral-storage limits on large workspaces. Learn more.
  • New opt-in mcpServer deployment (Helm only) to run the GitGuardian MCP server in your cluster. Disabled by default (currently in beta); set mcpServer.enabled: true to deploy it.

Fixes​

• Security fix preventing a Service Account Token from revoking itself through the public API; incident assignment now auto-grants access to the assignee; privacy-mode line misalignment in incident details; clearer error for unreachable custom webhook URLs; auto-grant developer access playbook corrections; JFrog Container Registry now discovers all repositories; GitLab health check no longer marks a reachable instance unavailable on a 4xx response. Learn more.
• Discord webhook alerts now trigger correctly; False Positive tag display and filtering in the incidents dashboard; Team Perimeter tree/list selection state; NHI Inventory "files requiring code fix" count consistency between UI and API. Learn more.
• Self-Hosted:
  • Enabling observability (CloudWatch) on AWS EKS no longer breaks the readiness and liveness probes.
  • Fixed a database compatibility issue that could cause the daily in-app analytics job to fail, so your analytics dashboards stay up to date.

Version	Release Date
2026.6.0	June 19, 2026
2026.6.1	June 23, 2026

System Requirements Update​

Ensure your infrastructure meets the latest requirements for optimal performance and security:

Helm & Upgrade Considerations​

To ensure compatibility, please review Helm values updates from the previous version. Air gap deployment? Find all the images and tag names in the air gap install page.

Feature highlights​

• Premium scan retry worker (Helm only) — a new optional, dedicated worker retries failed premium (VCS) scans on a high-memory pod. Large repositories that fail a scan — most often on out-of-memory errors — are retried here instead of repeatedly failing on the standard scanner pool. This lets you keep your base worker-scanners pods small and route only the heavy retries to one or two large, scale-to-zero pods. Learn more.
• Open-source agent skills for ggshield — the new GitGuardian/agent-skills repository ships open-source skills that teach AI coding assistants like Claude Code and Cursor when to scan, how to read findings, and how to walk developers through remediation. Learn more.

Secrets Detection Engine​

• v2.163 — 6 new detectors (Aikido API OAuth2 Credentials, Logflare Access Token, PolyAPI API Key, Apollo.io API Key, AES Cipher Key, SAP OAuth Credentials — replacing sap_ai_core_credentials), 1 new checker (SAP OAuth Credentials), 3 detector precision/format improvements (Azure DevOps PAT, GitHub App Token, Pagar.me API Key), 1 updated checker (Coralogix Personal Key), 2 analyzer updates (Datadog API Credentials, Azure OpenAI).
• v2.164 — 6 new detectors (Authentik API Token, Pagar.me Encryption Key, Adobe Refresh Token, LiteLLM API Key, brapi.dev API Key, Open VSX Access Token), 1 new checker (Google OAuth2 Keys), 6 detector precision improvements (Snyk Key, Finicity Authentication Keys, Hunter API Key, Datadog API Credentials, GitHub PAT, Heroku Platform Key), 1 new analyzer (Adafruit IO API Key).
• v2.165 — 8 new detectors (Stitch API Key, ActiveMQ Credentials, Instantly API Key, Gitea Access Token, Fal.ai API Key, SurrealDB Cloud JWT Token, Kimi API Key, Wiz OAuth Credentials), 8 new checkers (Okta Token, Okta OAuth Credentials, Azure Communication Services Connection String, Azure Storage Account Key, AWS Cognito OAuth 2.0 Credentials, LaunchDarkly SDK Key, Pulumi Access Token, Python Package Index Key), 6 updated checkers (AWS IAM Keys — all regions, Sumo Logic Keys, Supabase API Key, Vultr Key — v2 API, Baidu AI API Key, SAP OAuth Credentials), 1 detector precision improvement (Azure Active Directory API Keys).

Enhancements​

• Microsoft Teams granular alerting for internal monitoring — subscribe to specific incident event types per channel for fine-grained control over notification preferences. Learn more.
• Jira Cloud recurrent scanning instead of webhooks, and VCS historical scans now cover orphaned commits, Git notes, and pull/merge request refs. Learn more.
• Overview analytics now include NHI; GitHub check runs can skip merge commits; dissociate Jira/ServiceNow tickets from incidents; GitLab read-only group hook tokens. Learn more.

Fixes​

• Fixed an issue where unmonitored sources were incorrectly displayed as deleted in the user interface. Learn more.
• Security XSS fix on the mTLS redirect page; custom remediation guidelines now shown on developer share links; Jira & Confluence rate-limit scanning error; GitHub Forbidden error on unauthenticated API root requests. Learn more.
• Self-Hosted: Fixed an in-app Analytics failure that blocked the analytics run from completing.

Hotfixes​

2026.6.1​

  Release Date: June 23, 2026

Fixes​

• ggshield: Fixed ggshield auth login on self-hosted.