Most large enterprises have some version of a vault program, the combination of policy, platform, process, and ownership used to manage machine credentials. It includes the secrets manager itself, the teams that operate it, the IAM policies…
We have stopped counting the number of waves in the Shai-Hulud attack series, but this week has seen the rise of yet another iteration.This campaign started with the infection of the keyv@6.0.0 npm package at 9:35 a.m. UTC on Aug. 4, 2026,
The Month GitHub Public Contributions ExplodedTo date, GitHub remains the most widely used code storage cloud platform. The amount of data pushed to GitHub every year is tremendous. In 2025 alone, GitGuardian’s Public Monitoring platform an…
Agentic AI expands the security boundary of workflow automation. An n8n agentic workflow does not just generate an answer. It uses stored credentials to act across source control, databases, cloud platforms, AI providers, and SaaS applicati…
👉TL;DR: Credential harvesting is the large-scale collection of valid credentials that lets attackers log in as legitimate users. Developer machines are an especially rich source: unlike phishing, the credentials already sit in plaintext on…
👉TL;DR: The containment clock starts immediately after a developer's laptop is compromised, an infostealer fires an alert, a device goes missing, or a dependency turns malicious.While important, EDR and incident response only tell you what…
On July 16, 2026, Hugging Face disclosed unauthorized access to a limited set of internal datasets. Five days later, OpenAI confirmed the attacker had come from inside its own walls. A combination of OpenAI models, including GPT-5.6 Sol and…
This is the second article in a series on time to revoke, following our piece on The Hacker News. The first explains how to measure the amount of time an exposed credential remains usable. This article focuses on the operational changes sec…
If you run an application security program in 2026, secrets detection can look like a solved line item. Your static analysis suite ships rules for hardcoded credentials. Your code platform's built-in scanner flags API keys on push. So when
👉TL;DR: Identity-local signals show whether a credential or machine identity is risky. Topology signals show what breaks if that identity is abused. GitGuardian identifies and ranks exposed credentials and risky machine identities; Anyshif…
Between early June and July 14, 2026, four more supply chain attacks hit npm and PyPI.The Miasma worm we flagged in our last post did not stop at Red Hat's packages. It kept spreading across npm through June 5, reaching the Vapi server SDK
This is a follow-up to an article we published in The Hacker News introducing time to revoke as a critical CISO metric. This version provides a practical guide for measuring it across exposed secrets and non-human identities.👉TL;DR: Time t…