Linking GitGuardian as a source
This source is currently in alpha. The interface and available tables may change.
The GitGuardian connector syncs your secret incidents, their occurrences, monitored sources, honeytokens, members, and teams into PostHog, so you can track exposure volume, remediation time, and per-repository risk alongside your other engineering data.
Prerequisites
You need a GitGuardian workspace and an API token. Reading incidents requires a token with at least the Manager access level. EU and self-hosted GitGuardian instances are also supported.
Adding a data source
- In PostHog, go to the Sources tab of the data pipeline section.
- Click + New source and click Link next to this source.
- Enter your credentials (see Configuration below) and click Next.
- Select the tables you want to sync, choose a sync method and frequency, then click Import.
Once the syncs are complete, you can start querying this data in PostHog.
When linking GitGuardian, you'll need:
- API token – create a service account token (recommended for unattended syncs) or a personal access token in your GitGuardian API settings. Grant the read scopes for the tables you want to sync:
incidents:read,sources:read,honeytokens:read,members:read, andteams:read. - API URL (optional) – leave blank for the US SaaS instance. Workspaces on the EU instance should set it to
https://api.eu1.gitguardian.com; self-hosted instances should enter their own API URL (must be HTTPS).
Available tables
| Table | Description | Sync method |
|---|---|---|
secret_incidents | A detected secret with its triage status and remediation timeline | Incremental on date |
secret_occurrences | A single place a secret was found (commit, file, ...) | Incremental on date |
sources | A monitored source (repository, ...) with scan health and incident counts | Full refresh |
honeytokens | Decoy credentials and whether they were triggered | Full refresh |
members | Workspace members with their access level and activity | Full refresh |
teams | Workspace teams | Full refresh |
Incremental syncs on the incident and occurrence tables use a 7-day lookback window. Rows are detected with an immutable date timestamp, but triage fields like status, resolved_at, and presence keep changing afterwards. The lookback re-reads recently detected rows each sync to pick up those late changes; merge deduplication on the row id prevents duplicates. Status changes on rows older than the lookback window are only recaptured by a full refresh.
Full refresh tables reload all data on each sync. These are typically small and have no stable timestamp to sync on.
Sync modes
Each table can be synced in one of several modes, depending on what the source supports:
- Webhook (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
- Incremental – only new or updated rows are synced on each run, using a cursor field (such as an
updated_attimestamp). Cheaper than a full refresh, but deletes aren't captured. - Append only – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
- Full refresh – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.
See sync methods for a full explanation of how each mode works and how to choose between them.
Configuration
| Option | Type | Required |
|---|---|---|
API token | password | Yes |
API URL (EU or self-hosted only) | text | No |
Supported tables
| Table | Description | Sync method | Incremental field | Primary key |
|---|---|---|---|---|
secret_incidents | A secret incident regroups every occurrence of the same secret detected across your monitored perimeter, with its triage status and remediation timeline. | Incremental, Full refresh | date | — |
secret_occurrences | A single place a secret was found: one match of an incident's secret in a specific commit, file, or other monitored location. | Incremental, Full refresh | date | — |
sources | A monitored source in your GitGuardian perimeter (repository, VCS org, ...), with its scan health and open incident counts. | Full refresh | — | — |
honeytokens | A honeytoken (decoy credential) created in your workspace, with its trigger status showing whether it was used. | Full refresh | — | — |
members | A member of your GitGuardian workspace, with their access level and activity. | Full refresh | — | — |
teams | A team in your GitGuardian workspace, used to scope incidents and sources to groups of members. | Full refresh | — | — |
Troubleshooting
- If syncs fail with an authorization error, the token was likely revoked or expired. Create a fresh token in your GitGuardian API settings and reconnect.
- If a specific table reports a permission error, the token is missing that table's read scope, or (for incidents) the token's access level is below Manager. Update the token's scopes and access level, then retry.
- GitGuardian rate-limits API tokens and enforces monthly call quotas. Large initial backfills on busy workspaces may be slowed down by rate limiting; syncs back off and retry automatically.
If your sync is failing or data looks wrong, see the Data warehouse troubleshooting guide. If that doesn't help, contact support – we're happy to help.