We're excited to announce the Tracebit Open Source Program for our Tracebit Community Edition: unlimited free canary credentials for maintainers to use across all their public open-source repositories. With trusted development tools in the cross hairs of threat actors, security canaries can play a vital role in keeping open source projects safe.
Docker, ClickHouse, and Redis are joining us as some of the program's first participants. We're grateful for their support and we're opening the program to maintainers of projects of every size.
The offer is simple. Sign up for Tracebit Community Edition, tell us you maintain open-source projects, and we'll enable unlimited canary credentials for those repositories. In return, we ask you to display a "Protected by Tracebit" badge in your repository READMEs, helping other maintainers discover the program.
Giving back to the people building open source
When we launched Community Edition, we wanted to make security canaries available to anyone, including people without a security budget.
Open-source maintainers were a big part of that thinking. They review contributions, manage dependencies, publish releases, and respond to issues for software that other people depend on. Security is another responsibility on an already long list.
We want to help by making it easy to add security detection to the infrastructure behind those projects to protect against supply chain and credential theft attacks.
Community Edition already supports canary deployment across up to 10 GitHub repositories. Through this program, we're removing that limit for public open-source projects. Whether you maintain a handful of libraries in your spare time or look after your company's open-source repositories, you can deploy canaries across all of them for free.
Why build pipelines need detection
The Shai-Hulud worm showed how quickly a trusted package can become a route into thousands of other projects.
When it first appeared in September 2025, Shai-Hulud scanned each machine it reached for secrets, took the npm tokens it found, and used them to publish infected versions of every other package that maintainer owned. Each new install became another starting point. Two months later, Shai-Hulud 2.0 went further, running inside CI pipelines and stealing AWS, GCP and GitHub credentials. Wiz counted more than 25,000 malicious repositories created to publish what it stole.
For a maintainer, the concern extends beyond a single repository. Credentials used to build and publish your software can give an attacker a way to reach the people who depend on it.
That's why we built a GitHub Actions integration for Community Edition, and why we want to make it available across as many open-source projects as possible.
How the canaries work
The Tracebit GitHub Action places canary credentials into your workflow's build environment, alongside the places an attacker would look for real credentials. These canaries are real cloud credentials that have no legitimate use so any unexpected use is a signal of compromise.
If malicious code steals them and an attacker or automated tool attempts to use them, Tracebit sends you an alert, with context identifying the affected repository, workflow, and run.
That gives you a concrete signal to investigate when credentials are being used outside your pipeline.
You can read more about the integration and our testing in our technical walkthrough.
An Improved Community Edition Experience
Alongside the program, we've updated the community edition with a fresher UX and more features.
Participants in the Open Source Program will have access to Perimeter Sensors. A Perimeter Sensor imitates a service an attacker would want to reach, such as a private npm registry, and issues canary credentials that only work against it. Your GitHub Action runs inject them alongside your real secrets, so any use is a clear signal of repo or secret compromise.
Join ClickHouse, Docker, and Redis
We're pleased to welcome Docker, ClickHouse, and Redis among our first participants. Their involvement helps introduce canary detection to more maintainers, and we hope many more projects will join them.
You don't need a large user base, a dedicated security team, or a company behind your project to participate.
To get started:
- Sign up at community.tracebit.com or if you're an existing user, login and navigate to the Dashboard
- Apply in the Community Edition dashboard
- We'll enable unlimited repo coverage and new canary credential types from our Perimeter Sensors for your open-source repos and help you get started with the badge.
The badge helps other maintainers discover the program, so they can get free canary credentials for their public open-source repositories too.
We're grateful to the people who put their time into maintaining software for everyone else. We hope this makes one part of that work a little easier.