GitGuardian
Connect GitGuardian to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect GitGuardian to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.
| Category | Vulnerability Scanning |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| GitGuardian's guide | docs.gitguardian.com |
Connect with an API token
-
In GitGuardian:
- Business plan (recommended), as a workspace Manager: go to the Service accounts page in the API section of your workspace and click Create service account.
- Name the service account (for example Safeguard-Prod) and set an expiry date (1 week, 1 month, 3 months, 6 months, 1 year, or never).
- Choose the scopes incidents:read (view only permission on incidents) and sources:read (view only permission on sources).
- Click Create service account and copy the token. It will no longer be visible in the future.
- Other plans: go to the Personal access tokens page in the API section of your workspace, click Create token, name it, set an expiry date, click Create token, and copy the token (it will no longer be visible).
Where to find the other values:
- Region (optional): The GitGuardian region your workspace is hosted in.
- Base URL (optional): Only for self-hosted GitGuardian: the API URL of your instance.
GitGuardian shows the secret only once, so copy it before you leave the page.
Service accounts require the Business plan and only workspace Managers can manage them. A personal access token only returns what its creator can access via the UI, and each user may have at most 5. The fetched personal-access-token steps do not mention a scope picker, so no scope step is given for that path; the scope names for service accounts are from GitGuardian's authentication page. Region names and host names were not in the fetched pages.
Source: docs.gitguardian.com, docs.gitguardian.com, docs.gitguardian.com, checked 2026-10-07.
The permissions Safeguard needs:
incidents:read,sources:read. -
On Compliance › Connectors, open GitGuardian, click Connect, choose API token and fill in:
Field What to enter API token Required. Stored encrypted and never shown again. Region (optional) — Base URL (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read GitGuardian and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC7.1 | 3 |
| ISO/IEC 27001 | Automated tests | A.8.8 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1) | 3 |
| PCI DSS | Automated tests | 6.3.3, 11.3.1 | 3 |
| NIST CSF 2.0 | Automated tests | ID.RA-01, ID.RA-06 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vulnerability Scanning connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks