Free, forever. Built for builders.
Worried about your repos getting hacked?
Would you even know if your keys were getting exposed?
Most teams find out from a customer, a researcher, or a postmortem, weeks later. Set up detection now and know the moment it happens.
- Free forever
- Installs in your GitHub Actions workflow
- Up to 10 repos covered
Open Source Program
Maintain open source? Protect every public repo, free.
Community Edition covers up to 10 repositories. If you maintain public open-source projects, we’ll lift that limit.
All we ask is a “Protected by Tracebit” badge in your READMEs, so other maintainers can find the program.
See the Open Source Program- Unlimited canary tokens across your public repositories
- Canary package-registry credentials
- Free forever, for maintainers of projects of every size
First participants
Security canaries
What are canaries?
A canary is a decoy: a credential that looks exactly like a real one, but never gets used. So the moment anyone tries to, you know something is wrong.
Tracebit Community Edition protects your GitHub Actions workflows with AWS canary credentials and SSH key canaries, deployed alongside your real ones.
If anyone touches them, we’ll send you an alert. It’s a quick win you can set up in any GitHub project, and it takes under 5 minutes.
- 1 # .github/workflows/deploy.yml
- 2 DEPLOY_TOKEN=${{ secrets.DEPLOY_TOKEN }}
- 3 NPM_TOKEN=${{ secrets.NPM_TOKEN }}
- 4 AWS_ACCESS_KEY_ID=AKIA3F2NXJ7Q9P8KX1MZ← canary
- 5 SENTRY_DSN=${{ secrets.SENTRY_DSN }}
- 6 SSH_DEPLOY_KEY=-----BEGIN OPENSSH PRIVATE KEY-----← canary
This is what your inbox looks like when something trips a canary.
-
just now
AWS canary credential used
AKIA3F2NXJ7Q9P8KX1MZ94.198.55.12 -
20 days ago
SSH canary key touched
root@bastion-eu-2185.143.223.41 -
71 days ago
AWS canary credential used
AKIA7K2QXJ4N1V8MZ3PR73.140.187.92
Why it matters
It’s no longer enough to assume you won’t be hit.
Some of the repos compromised recently had large teams with great security. If it can happen to them, it can happen to anyone. Detection needs to be in place to catch it the moment it reaches you. Recent attacks include:
2026 · Open source toolchain
TeamPCP
Compromised Trivy, KICS, LiteLLM and Telnyx to distribute malware that stole cloud credentials, SSH keys and CI/CD secrets.
GitHub Actions
tj-actions
Attackers modified a widely used GitHub Action to dump build secrets into workflow logs. Public logs exposed those secrets to anyone.
npm
s1ngularity
Attackers stole an npm publishing token and released malicious versions of Nx that harvested credentials from developer machines.
Self-replicating worm
Shai-Hulud
A worm harvested credentials from infected environments and used stolen npm tokens to publish infected versions of more packages.
Learn more in Alessandro Brucato’s published research.
Perimeter Sensors · Open Source Program
Detect attackers going after your publishing credentials.
A compromised dependency or GitHub Action can steal credentials from your build environment. With your publishing token, an attacker can release malicious versions of your packages under your project’s name.
In the Nx/s1ngularity attack, attackers exploited Nx’s own GitHub Actions workflow to steal its npm publishing token, then published malicious versions of Nx. Shai-Hulud automated the pattern: it harvested npm tokens from infected environments and used them to publish infected versions of more packages.
Open Source Program members can deploy canary package-registry credentials alongside their real ones. They point at a Perimeter Sensor, a decoy registry that looks like the real thing, and any attempt to authenticate with one raises an alert.
-
Tokens next to your real ones
Canary registry credentials sit in your build environment alongside your real publishing tokens. Nothing legitimate ever uses them.
-
An alert on first use
When a canary credential is presented to a Perimeter Sensor, Tracebit alerts you with details of the attempt.
Perimeter Sensors in Community Edition are part of the Open Source Program.
Permissions and trust
What happens when you connect Tracebit
Setting up the integration takes about a minute. Here’s exactly what we do with the access you grant.
The permissions we ask for, and why
| GitHub permission | What we use it for |
|---|---|
| Read - Actions & Metadata | To see your workflows and their runs, so we can place canaries in the right spot and confirm your pipelines are protected (this is how we calculate your coverage). |
| Read & write - Workflows | GitHub requires this specific permission to add our canary step to the files in your .github/workflows/ folder. |
| Read & write - Code & Pull requests | To open a pull request that adds the integration to your workflows. You review and merge it. We never push to your branches directly. |
What we send to Tracebit
Only metadata about your workflow runs: the repository name, workflow name, job, commit SHA, and run ID. That’s what lets us tie an alert back to the exact pipeline if a canary is ever triggered.
What we write
A single pull request that adds the Tracebit canary step to your workflows. You see the diff, you approve it, you merge it. Nothing changes until you say so.
What we never touch
Your real secrets and keys never reach our infrastructure. Canary credentials are decoys we issue, not your real ones.
We don’t read or ingest your business logic, source code, or environments. The only code we look at is the workflow files we need to integrate with.
We don’t merge, deploy, or change anything outside the pull request you approve.
Built with community security in mind, and it stays free.
We want to help you protect your repos and your work, and we want your feedback. If the limits don’t cover what you need, or there’s a feature you’d love to see, tell us at community@tracebit.com.
Frequently asked questions
Is it really free, forever?
Yes. Community Edition was built to make security canaries accessible to all and it'll stay that way.
I maintain open-source projects. What do I get?
Through the Open Source Program, unlimited canary tokens across your public repositories, plus canary package-registry credentials. Sign up and apply in the Community Edition dashboard.
Do I need to be a security engineer to use this?
No. Community Edition is built so anyone can deploy it, no security background required.
Does Tracebit read my code?
No. The only code we read is the workflow files we integrate with. See Permissions and trust above.
Can an attacker tell a canary is fake?
The credentials are created exactly the same way as real credentials, so attackers cannot tell the difference.
Does this really catch supply chain attacks?
Yes. Read more in Alessandro Brucato's published research.