Skip to content

GitGuardian

GitGuardian monitors connected sources for suspected credentials and organizes findings into incidents that a team can handle.

Visit GitGuardian

Which repositories should GitGuardian monitor?

Start with an owned repository your team has approved for monitoring. The GitHub integration can be installed for selected repositories. Check which ones the GitHub app can access, and which ones the workspace actually monitors.

Review what code and findings the integration processes. Before changing access, check the separate monitoring and app-installation settings. Removing a repository from monitoring stops future alerts from it while the GitHub app can remain installed.

How does the Starter plan count your team?

Starter includes Internal Monitoring for up to 25 contributing developers. GitGuardian counts contributors from commits to qualifying business repositories in a rolling 90-day window. A private repository within a GitHub organization qualifies for that count. Check your workspace’s actual number and monitored sources.

Keep track of where new repositories are added. The plan guide describes a trial or monitoring stoppage after passing the Starter limit, depending on whether the trial is still available.

Does closing an incident disable the credential?

Assign the incident to the owner of the service that issued the credential. The platform has integrated revocation for supported providers when it is enabled. Otherwise the owner needs to revoke it at the issuing service. Verify the result there and check that your app uses a replacement.

Keep a restricted response record with the repository, service, owner, action taken and time. If you move monitoring tools, recheck the repository list, who receives alerts and who owns open work. Existing incident history can remain after an integration is removed.

How can a small team rehearse an alert?

Draw a fictional alert for a booking app. Use no account, scan, provider or credential value.

  1. Give the alert an owner
    Write which role manages the service. Tell them where the finding appeared using a label.
  2. Record separate outcomes
    Mark revocation confirmed, app updated, and app checked as separate boxes.
  3. Draw a missing alert
    Show who checks whether a repository remains monitored. No provider response or alert delivery was tested.