Free for open-source maintainers
Tracebit Open Source Program
Unlimited free canary credentials for maintainers to use across all their public open-source repositories.
- Unlimited canary credentials for public open-source repositories
- Free forever, for maintainers of projects of every size
- Installs in your GitHub Actions workflow in under 5 minutes
- Docker, ClickHouse and Redis are among the first participants
All we ask in return
Display a “Protected by Tracebit” badge in your repository READMEs, so other maintainers can discover the program.
Join the program
You apply from inside Community Edition. It takes a couple of minutes.
- Sign up to Community Edition
- Apply in the Community Edition dashboard
- We’ll enable unlimited canary credentials for those repos in exchange for our badge in your READMEs
First participants
Why we built this
Security is one more job on a long list.
When we launched Community Edition, we wanted to make security canaries available to anyone, including people without a security budget. Open-source maintainers are exactly the people we want to help. They review contributions, manage dependencies, publish releases, and respond to issues for software that other people depend on. Security is another responsibility on an already long list.
Community Edition already supports canary deployment across up to 10 GitHub repositories. Through this program, we’re removing that limit for public open-source projects.
Security canaries
What are canaries?
A canary is a decoy – a credential that looks exactly like a real one, but never gets used. So the moment anyone tries to, you know something is wrong.
Tracebit Community Edition now protects your GitHub Action workflow with AWS canary credentials and SSH key canaries deployed alongside your real ones.
If anyone touches them, we’ll send you an alert. It’s a quick win you can set up in any GitHub project and takes under 5 minutes.
Open Source Program participants also get access to canary package-registry authentication tokens. They point at a Perimeter Sensor, a decoy registry that looks like the real thing, and any attempt to authenticate with one raises an alert.
- # .GitHub/workflows/deploy.yml
- DEPLOY_TOKEN=${{ secrets.DEPLOY_TOKEN }}
- NPM_TOKEN=${{ secrets.NPM_TOKEN }}
- NPM_REGISTRY_TOKEN=npm_4fQ9xT2LmZ8cR1vK7bN3pW6yH0sJ5dE1aU9g ← canary
- AWS_ACCESS_KEY_ID=AKIA3F2NXJ7Q9P8KX1MZ ← canary
- SENTRY_DSN=${{ secrets.SENTRY_DSN }}
- SSH_DEPLOY_KEY=-----BEGIN OPENSSH PRIVATE KEY----- ← canary
When someone uses a canary, you get an alert like this.
Why it matters
It’s no longer enough to assume you won’t be hit.
Some of the repos compromised recently had large teams with great security. If it can happen to them, it can happen to anyone. So it’s really important to have detection in place to catch it the moment it affects you. Recent attacks include:
2026 · Open source toolchain
TeamPCP
Compromised a chain of widely-used open source tools earlier this year — Trivy, KICS, LiteLLM and Telnyx among them.
GitHub Actions
tj-actions
A popular action was modified to exfiltrate secrets from every workflow that pulled it in. Thousands of repos affected.
npm
s1ngularity
Typosquatted npm packages quietly harvested credentials from any build environment that installed them.
Self-replicating worm
Shai-Hulud
The first self-propagating npm supply chain worm. Spread by stealing tokens from every pipeline that touched an infected package.
Learn more in Alessandro Brucato’s published research.
Permissions and trust
What happens when you connect Tracebit
Setting up the integration takes about a minute. Here’s exactly what we do with the access you grant.
The permissions we ask for, and why
| GitHub permission | What we use it for |
|---|---|
| Read — Actions & Metadata | To see your workflows and their runs, so we can place canaries in the right spot and confirm your pipelines are protected (this is how we calculate your coverage). |
| Read & write — Workflows | GitHub requires this specific permission to add our canary step to the files in your .github/workflows/ folder. |
| Read & write — Code & Pull requests | To open a pull request that adds the integration to your workflows. You review and merge it — we never push to your branches directly. |
What we send to Tracebit
Only metadata about your workflow runs — the repository name, workflow name, job, commit SHA, and run ID. That’s what lets us tie an alert back to the exact pipeline if a canary is ever triggered.
What we write
A single pull request that adds the Tracebit canary step to your workflows. You see the diff, you approve it, you merge it. Nothing changes until you say so.
What we never touch
- Your real secrets and keys never reach our infrastructure. Canary credentials are decoys we issue — not your real ones.
- We don’t read or ingest your business logic, source code, or environments.
- We don’t merge, deploy, or change anything outside the pull request you approve.
Need more coverage than your repositories?
Tracebit deploys canaries across your cloud accounts, identity providers, workstations and CI/CD, not just your GitHub workflows.
FAQs.
Answered.
Who qualifies for the Open Source Program?
Maintainers of public open-source repositories. You don’t need a large user base, a dedicated security team, or a company behind your project to participate.
Is it really free, forever?
Yes. Community Edition is free and will remain free. The Open Source Program removes the 10-repository limit for your public open-source projects at no cost.
Do I have to display the badge?
We ask you to add the “Protected by Tracebit” badge to your repository READMEs. It’s how other maintainers find the program.
Does Tracebit read my code?
No. The only code we read is the workflow files we integrate with. We don’t read or ingest your business logic, source code, or environments.
Can an attacker tell a canary is fake?
The canaries are real, valid-looking credentials with no legitimate role in your build. Distinguishing them from your real secrets is the problem an attacker has to solve, and attempting to use one is what raises the alert.
I already have a Community Edition account. What do I do?
Sign in to Community Edition and apply from the dashboard. We’ll enable unlimited canary credentials on your existing account.