blog.gitguardian.com resources

blog.gitguardian.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-06-25.

Secrets 16 Supply Chain 11 AI 5 AuthZ 3 AuthN 2 API Sec 1 Python 1

Date Added	Resource	Excerpt
2026-06-25 2026	Hunting Leaked PyPI Tokens: 62 Live, 125 Packages Exposed Python Secrets Supply Chain	Analysis of leaked PyPI tokens reveals 62 live credentials, impacting 125 packages with approximately 25,000 monthly downloads. Using the `pypitoken` Python module, researchers decoded macaroons to identify token restrictions, such as `UserIDRestriction` and `ProjectIDsRestriction`. A method mimicking the `twine upload` command was employed to test token validity, with a 400 HTTP response indicating a live token. Despite GitHub's automated scanning, numerous tokens, many first leaked in 2024, remained active, suggesting gaps in automated detection. Responsible disclosure to the PyPI security team led to token revocation and improvements in their disclosure process.
2026-06-25 2026	Identiverse 2026: The Challenges Of Solving Identity For AI Agents At Scale AI AuthZ	Reference from Identiverse 2026 highlights challenges in solving identity for AI agents at scale, discussing ownership, lifecycle management, and least privilege. Sessions addressed risks like unauthorized agent decisions, the need for agent identity before production, and secure credential management, emphasizing techniques such as intent-scoped, just-in-time access and eliminating secrets via SPIFFE-based attestation and per-workflow OIDC tokens. The discussion also noted how AI coding tools can inadvertently teach developers insecure practices, like using static credentials, and stressed the importance of architectural decisions to enforce secure paths and provenance tracking in agent-to-agent interactions.
2026-06-17 2026	Extending Our Mission With Developer Endpoint Protection Secrets	Library extending ggshield for developer endpoint protection, it finds credentials on developer machines, including those accumulated in shell histories, config files, and AI agent artifacts. It employs local scanning, honeytokens for live attack detection, and integrates with enterprise deployment workflows, MDM solutions, and SIEM systems to secure the growing attack surface presented by AI coding agents like Cursor and GitHub Copilot.
2026-06-16 2026	Gitguardian Agent Skills: Secret Detection and Remediation For AI-Assisted Development AI Secrets	Library of GitGuardian Agent Skills enabling AI coding assistants to perform secret detection and remediation. These skills translate developer concerns into concrete actions, guiding AI agents to utilize `ggshield` for scanning repositories, local machines, and Git history for secrets. Supported slash commands include `/gitguardian:scan-secrets` for various scan types, `/gitguardian:create-honeytokens` for decoy credentials, `/gitguardian:scan-machine` for comprehensive local audits, `/gitguardian:check-hmsl` for checking leaked secrets without exposing them, and `/gitguardian:install-git-hooks` to integrate `ggshield` as pre-commit or pre-push hooks.
2026-06-13 2026	KCD New York 2026: Trust, Agents, and the Work Behind the Work AI API Sec AuthZ	Library summarizing Kubernetes Community Days New York 2026, focusing on "Zero Trust for APIs" with Istio Ambient Mesh, the complexities of Kubernetes CVEs and AI vulnerability assessment, and autonomous multi-cluster remediation using agentic AI and MCP servers. It also highlights the importance of community in open-source infrastructure, referencing the New Contributor Orientation program.
2026-06-11 2026	You Can't Secure What You Can't See: Making Non-Human Identities Governable AuthN Secrets	Library for governing non-human identities, GitGuardian NHI Governance provides a centralized, searchable inventory of machine identities across secrets managers, CI/CD, cloud IAM, Kubernetes, and SaaS platforms. It surfaces NHIs with their source, path, environment, risk level, and ownership status, enabling continuous governance by identifying public leaks, internal leaks, cross-environment secrets, reused credentials, long-lived secrets, and overprivileged identities. This context allows teams to understand dependencies before revoking or rotating credentials, shifting from reactive incident response to proactive security.
2026-06-08 2026	Initial Access Changed, The Attack Path Did Not: Findings From The Verizon 2026 DBIR AuthN Secrets Supply Chain	Survey of 2026 DBIR findings highlighting credential abuse and exploited vulnerabilities as primary attack vectors, emphasizing the critical role of leaked credentials, API keys, and tokens in both initial access and lateral movement. The analysis details how DevSecOps workflows, third-party integrations like OAuth, and the increasing use of AI by attackers create extensive credential exposure paths, turning leaked secrets into reusable attacker assets that enable ransomware and system intrusions. Incident response requires thorough credential exposure analysis to understand the blast radius and revoke compromised access.
2026-06-08 2026	Top 16 Secrets Management Tools and Platforms for 2026 (Compared)Secrets	Library comparing 16 secrets management tools including CyberArk Conjur, HashiCorp Vault, Akeyless, Doppler, and 1Password Secrets Automation. It covers elements like automated secrets rotation, role-scoped access, and integrations with systems like GitHub Actions, Azure DevOps, and Kubernetes through tools like External Secrets Operator. The library highlights key considerations for choosing a tool based on cloud environment, open-source priorities, and AI agent support, noting the increasing prevalence of exposed secrets in public GitHub commits and internal repositories.
2026-06-08 2026	Four Credential-Harvesting Campaigns Hit Open Source Ecosystems in Two Weeks Secrets Supply Chain	Survey of four recent credential-harvesting campaigns—Megalodon, Laravel-Lang, TrapDoor, and Miasma—targeting open source ecosystems, including GitHub, npm, PyPI, Crates.io, and Composer. These attacks compromised repositories and packages, exploiting CI workflows, Git tag rewriting, and various execution paths to exfiltrate sensitive data like cloud credentials, SSH keys, and AI coding assistant instructions, without relying on zero-days.
2026-06-08 2026	Designing Identity for the Agentic Enterprise: The Okta AI Identity Summit AI AuthZ	Reference on agentic enterprise identity, summarizing insights from the Okta AI Identity Summit. It highlights how AI agents are rapidly outpacing existing identity systems, necessitating a shift from mere access control to governing specific actions. Key takeaways include the need for agent discovery, understanding connections, real-time governance via access certifications and kill switches, and the integration of identity as a core control plane for AI. The summit emphasized that successful AI transformation requires rewiring work processes and trust, not just deploying new tools.
2026-05-19 2026	How We Got a CISA GitHub Leak Taken Down in Under a Day Secrets	Writeup details a CISA GitHub leak containing CI/CD logs, Kubernetes manifests, Terraform code, and AWS secrets discovered in the "Private-CISA" repository. The leak, which persisted for months before detection by GitGuardian, highlights risks from plain-text passwords, Git-committed backups, and exposed GitHub tokens. It emphasizes the importance of diligent secret management and comprehensive exposure monitoring to prevent similar incidents.
2026-05-04 2026	Local Guardrails for Secrets Security in the Age of AI Coding Assistants AI Secrets Supply Chain	Library for local secret scanning, ggshield, addresses the shift of software supply chain attack surfaces to developer workstations. It detects hardcoded credentials in .env files, terminal history, build output, and AI prompts, mitigating risks before they reach remote repositories or pipelines. The tool integrates directly into developer workflows via editors, Git hooks, terminals, and AI coding assistants, preventing credential exposure and simplifying incident response.
2026-04-23 2026	No Off Season: Three Supply Chain Campaigns Hit npm PyPI and Docker Hub in 48 Hours Supply Chain	Analysis of three recent supply chain campaigns targeting npm, PyPI, and Docker Hub, including Checkmarx KICS, CanisterSprawl (pgserve, Namastex.ai), and xinference, highlights the consistent objective of stealing developer secrets like API keys and cloud credentials. These attacks, attributed in part to threat actor TeamPCP, demonstrate sophisticated evasion techniques and cross-ecosystem propagation.
2026-04-22 2026	Top 10 Non-Human Identity Security Tools and Platforms for 2026 Secrets	Library for detecting and preventing non-human identity (NHI) security risks, specifically addressing hardcoded API keys, overprivileged service accounts, stale OAuth tokens, and misconfigured workload identities. It offers comprehensive discovery, exposure detection across git history and CI/CD pipelines, lifecycle management, authorization and least privilege enforcement, and governance features to aid compliance with standards like SOC 2 and ISO 27001. This tool targets large DevSecOps organizations to secure complex, multi-cloud, and ephemeral workloads.
2026-04-22 2026	AI Is Fueling Secrets Sprawl: GitGuardian Reports 81% Surge of AI-Service Leaks Secrets	Report detailing GitGuardian's findings on secrets sprawl, highlighting an 81% surge in AI-service leaks and a 34% YoY increase in newly leaked secrets on GitHub due to AI adoption. The analysis covers increased risk from AI-assisted commits, emerging MCP configuration risks, expanded attack surfaces via collaboration tools and developer machines, and challenges in prioritizing and remediating long-lived secrets, underscoring the need for dedicated Non-Human Identity governance.
2026-04-19 2026	Shai-Hulud: A Persistent Secret Leaking Campaign — GitGuardian Supply Chain	Analysis of the Shai-Hulud campaign details a persistent supply chain attack targeting NPM packages like @ctrl/tinycolor, using malicious GitHub Actions to exfiltrate secrets from local environments and repositories. Similar to the s1ngularity and GhostActions campaigns, this attack injects compromised workflows to steal credentials, including GitHub tokens, NPM tokens, and AWS Keys. GitGuardian's HasMySecretLeaked service allows developers to check for compromised secrets without exposing their values.
2026-04-16 2026	Supply Chain Security: Sigstore and Cosign - GitGuardian Supply Chain	Library for signing and verifying container images using Sigstore's Cosign. This resource details Sigstore, a suite of tools designed to secure software supply chains by ensuring software integrity. It focuses on Cosign, a tool for signing artifacts within OCI registries, utilizing features like hardware and KMS signing, and integration with Kubernetes Secrets. The library allows users to generate key pairs, sign images by digest, and verify signatures against a provided public key, addressing the challenges of managing and integrating cryptographic signing into CI/CD workflows.
2026-04-15 2026	The Future Of GitHub Actions Security And What You Can Do Right Now Supply Chain	Library for securing GitHub Actions, focusing on proactive measures and current realities. It addresses GitHub's evolving roadmap toward deterministic workflow dependencies, centralized execution policy, and tighter secret scoping. The library helps organizations manage the immediate risks of scattered secrets and compromised automation layers, providing visibility, detection, and remediation for existing environments before platform-level controls are fully implemented.
2026-04-11 2026	The Nx s1ngularity Attack: Inside the Credential Leak Supply Chain	Tool for scanning local environments for compromise from the Nx s1ngularity supply chain attack. It detects leaked credentials, including GitHub tokens, npm keys, SSH private keys, API keys, and cryptocurrency wallet files, and checks for exploitation of LLM client configuration files for tools like Claude and Gemini. The tool also provides a privacy-preserving service to check if specific secrets were exfiltrated.
2026-04-11 2026	Terraform Secrets Management Best Practices Secrets	Library for managing secrets within Terraform configurations. It highlights best practices such as avoiding hard-coded secrets, leveraging secrets managers like AWS Secrets Manager, and utilizing the `sensitive` flag for outputs. The library also details how Terraform states and plans can expose sensitive data and introduces ephemeral resources as a mechanism to fetch secrets without persisting them in the state file.
2026-04-11 2026	2,622 Valid Certificates Exposed: Google-GitGuardian Study Secrets	Survey of X.509 certificate leaks mapping over 40,000 private keys to TLS certificates, revealing 2,600 valid certificates at risk. The GitGuardian and Google study highlights a critical misunderstanding of private key risks, with many organizations failing to revoke exposed certificates after disclosure campaigns. Techniques used included Certificate Transparency log analysis and OSINT for attribution, uncovering systemic failures in key management and revocation processes across Fortune 500 companies, healthcare providers, and government agencies.
2026-04-10 2026	Renovate & Dependabot: The new Malware Delivery System Supply Chain	Library analyzing how automated dependency updaters like Renovate and Dependabot can inadvertently accelerate malware distribution in supply chain attacks. It details how these tools, designed for efficiency, can bypass security scrutiny by automatically merging malicious package updates, as seen with the Axios and trivy-action compromises. The entry highlights the implicit trust afforded to bot-generated pull requests and their potential to introduce malware rapidly, even into CI/CD pipelines through workflow modifications.
2026-04-10 2026	The State of Secrets Sprawl 2026: AI-Service Leaks Surge 81%Secrets	Report detailing the surge in hardcoded secrets on public GitHub, with AI service leaks increasing 81% and LLM infrastructure leaking 5x faster than core model providers. The analysis highlights insecure patterns in MCP configuration guides, the significant risk of secrets in internal repositories and collaboration tools like Slack and Jira, and the expanding attack surface of developer workstations and CI/CD runners due to AI agents. It also emphasizes the persistent issue of un-remediated valid secrets and the critical need for robust Non-Human Identity (NHI) governance.
2026-04-10 2026	Protecting Your Software Supply Chain: Typosquatting and Dependency Confusion Supply Chain	Library detailing typosquatting and dependency confusion attacks on software supply chains. These attacks exploit developers' typographical errors when downloading packages from registries like npm and PyPI, or through compromised dependencies. Real-world examples such as the Codecov and Event Stream breaches highlight how attackers infiltrate systems by mimicking legitimate packages, leading to data breaches, system compromises, and reputational damage. The library provides insights for engineering managers and security practitioners to protect their infrastructure from these evolving threats.
2026-04-10 2026	The State of Secrets Sprawl 2025 Secrets	Report on the State of Secrets Sprawl 2025 details a significant increase in leaked secrets, with 23.8 million found on public GitHub in 2024, a 25% rise. Generic secrets comprise 58% of leaks, and a troubling 70% of secrets from 2022 remain active, expanding the attack surface. The report highlights that 35% of private repositories also contain secrets, including AWS IAM keys and hardcoded passwords, and secrets are prevalent across the SDLC in tools like Jira and Slack. The U.S. Treasury Department's BeyondTrust breach illustrates the real-world impact of exposed credentials.
2026-04-03 2026	Secret Scanning Tools 2026: Protect Code and Prevent Credential Leaks Secrets	Library for detecting and preventing secret leaks in code, offering continuous scanning, broad detector coverage for AWS, GCP, Azure, and internal tokens, and integration with GitHub, GitLab, and Slack. It utilizes pattern matching, entropy detection, and context-aware validation, with machine learning to reduce false positives and dedicated remediation workflows to address detected issues across the software development lifecycle.