Initial Access Changed, The Attack Path Did Not: Findings From The Verizon 2026 DBIR
This year's report shows how credential sprawl across DevOps, SaaS, CI/CD, the cloud, and developer laptops turns initial access into operational impact.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
New in ggshield 1.51: Codex Hooks, MCP Discovery, and SLSA Provenance
ggshield 1.51 is here with better support for AI-powered development and browser-less environments. This release adds Codex hook support, MCP server detection across Claude and Cursor, and `ggshield auth login --method oob` for SSH sessions and headless servers. It also strengthens trust in the ggshield supply chain with GitHub Artifact Attestations for release binaries, improves plugin management through your authenticated GitGuardian instance, adds a `vscode` alias for Copilot hook installation, and shows workspace ID in `ggshield api-status`.
GitGuardian Just Gave AI Coding Agents Secret Detection Skills
AI coding assistants like Claude Code and Cursor are helping developers write more code faster, but that also means more chances for secrets to slip into prompts, files, commits, and tool outputs. GitGuardian’s new open-source **agent-skills** repository teaches AI agents how to use **ggshield** directly inside the developer workflow: when to scan, how to read findings, and how to guide remediation for leaked credentials.
BSides312 2026: Security Basics Under New Pressure
In an AI-assisted development era, the third edition of BSides312 showed why trust, identity, access, evidence, and community remain core to security work.
Grafana and GitHub Breached: The Risk When Private Code Leaks
Code from GitHub and Grafana is in criminal hands. Secrets buried inside could open doors no one is thinking of protecting yet, and AI will make hunting 0-days in that private code faster than ever.
Leaked Kubernetes Secrets: Impact Assessment and Mitigation Strategies
A single leaked Kubernetes credential rarely stays in the cluster. It opens the registry credentials, private Docker images, and private GitHub repositories behind it. In Q1 2026 alone, our detectors caught close to 2,000 new such leaks on GitHub, 28% valid at leak time.
An inside look at finding Leaked CISA AWS GovCloud Admin Keys on Github
In this interview, GitGuardian security researcher Guillaume Valadon breaks down how GitGuardian discovered a public GitHub repository exposing CISA-related secrets, including plain-text passwords, AWS tokens, SAML certificates, CI/CD files, Kubernetes manifests, and internal operational documentation. We discuss how the leak was identified, why exposed secrets can create immediate risk, and how GitGuardian helped escalate the disclosure until the repository was taken offline within 26 hours.
Malware is created by criminals
"Malware is created by criminals. They are intending to cause harm. It is not hypothetical. They want you to consume it for nefarious purposes.".
How We Got a CISA GitHub Leak Taken Down in Under a Day
On May 14, GitGuardian found a public GitHub repository called "Private-CISA" — 844 MB of plain-text passwords, AWS tokens, and Entra ID SAML certificates belonging to CISA, exposed since November 2025. Some credentials were still valid. CISA pulled it offline within 26 hours.
San Francisco Secure Software and AppSec Summit 2026: The Next AppSec Operating Model
Security leaders at this SF area Summit examined AI agent risk, dependency governance, stale infrastructure, and the future of secure software.
The GitGuardian Secret Detection Engine Just Got 43X Faster Thanks To Rust
While not a new feature, the GitGuardian team has been hard at work making updates to our TokenScanner, the underlying engine that powers GitGuardian's secret scanning ability. This is great news for folks dealing with very large repos and legacy platforms that thousands of developers have touched over the years. Scanning millions of files, attachments, commits, and anywhere else secrets might be hiding takes minutes. Historical scans across petabytes of information, which used to take days, now take less than an hour. What used to take hours takes a few short minutes.
64% of valid secrets GitGuardian tested in 2022 are still valid in 2026
Read the full report here (no email sign up required).
AI Agents Security for Developers: Don't Let Your Agents Become a Liability
Using Cursor, GitHub Copilot, Claude Code, Codex, or another coding agent means giving software access to more than your code. It can also see the credentials available in your workspace, shell, config files, and development environment.
GitGuardian Now Flags Admin and Overprivileged Identities Across AWS, Entra, and Okta
GitGuardian's NHI Governance now adds privilege context to leaked secrets, auto-escalating admin-level risks for smarter prioritization across AWS, Entra, and Okta. Discover how admin badges and overprivilege detection cut through noise to focus on true blast radius.
GCSI 2026: AI Readiness in a City Built in Layers
GCSI 2026 showed why cyber readiness depends on visibility into vendors, AI tools, identities, workflows, and hidden business dependencies.
How Attackers Use Developer Machines to Breach the Software Supply Chain - May 07, 2026
In April, three major supply chain campaigns hit npm, PyPI, and Docker Hub in just 48 hours, and while the ecosystems were different, the objective was the same: steal credentials from developer environments and CI/CD pipelines. The malware targeted API keys, cloud credentials, SSH keys, GitHub tokens, npm tokens, environment variables, and more, turning developer machines and build systems into high-value credential vaults for attackers.
Meet GitGuardian's AI Assistant: Natural Language Queries Across All Your Incidents
See how the GitGuardian Assistant helps teams investigate, understand, and remediate secret incidents directly from the GitGuardian workspace. In this preview, Mathieu and Dwayne walk through how the assistant uses incident context, workspace details, and GitGuardian documentation to answer questions, suggest next steps, and help manage incidents through natural language. It can explain threat patterns, assess scope and impact, recommend remediation steps, assign incidents, update tags, and propose changes to incidents.
Navigating With GitGuardian Workspace Quick Access
GitGuardian Workspace Quick Access helps you move through the platform faster with one unified search experience. In this video, we walk through how to open Quick Access with Ctrl+K, or Cmd+K on Mac, search across platform pages and public documentation, navigate results with keyboard shortcuts, and jump directly to the section you need. Quick Access respects your permissions and workspace configuration, so results stay relevant to the pages, features, and docs available to you.
Previewing GitGuardian Developer Endpoint Protection
We are excited to announce the private beta of our advancement in fighting secret sprawl and keeping your developers safe. GitGuardian Developer Endpoint Protection.
Local Guardrails for Secrets Security in the Age of AI Coding Assistants
Modern developer environments expose sensitive context across files, prompts, logs, and commands. Learn how layered local controls reduce secrets risk.