Why We Built the Good Samaritan Program

GitGuardian describes the evolution of its Good Samaritan Program, which has scanned public GitHub commits since 2018 and alerted individual developers when exposed credentials such as passwords, cloud keys, and tokens are found. Citing 28.65 million secrets pushed to public GitHub in 2025 and a finding that 64% of valid credentials discovered in 2022 remained unrevoked in 2026, the company argues that notifying developers alone often fails to protect the organizations that own leaked credentials. Its new Enterprise Good Samaritan Program uses automated attribution, AI-assisted triage, and human researchers to identify serious public exposures, determine the likely affected organization, assess credential validity and access, and notify relevant security teams without requiring them to be customers. GitGuardian says alerts include the location and status of the leak, potential access implications, and remediation guidance, with recipients advised to revoke or rotate credentials, examine logs, and investigate related repositories. The company also encourages organizations to establish clear channels for receiving external security disclosures, noting that alerts can otherwise be lost in generic contact or bug-bounty systems.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.