Tracebit offers unlimited canary credentials to open source

Tracebit has launched an Open Source Program that offers unlimited free canary credentials for public open-source repositories. Docker, ClickHouse and Redis are among the first participants.

The programme extends Tracebit's Community Edition for maintainers of public projects by removing the existing limit of 10 GitHub repositories for canary deployment. To take part, maintainers must sign up for the Community Edition, confirm they run open-source projects and display a "Protected by Tracebit" badge in their repository READMEs.

The move is aimed at developers and organisations that maintain open-source software but may not have a dedicated security budget or team. It is open to projects of all sizes, from individual maintainers running small libraries to larger corporate-backed repositories.

Supply chain focus

The launch comes amid continued concern over software supply chain attacks, particularly those targeting build pipelines and developer credentials. In open-source software, compromised publishing or cloud credentials can let attackers alter packages, insert malicious code or move into other projects maintained by the same developer.

Tracebit cited the Shai-Hulud worm as an example. It said the malware scanned infected machines for secrets, used stolen npm tokens to publish infected versions of other packages owned by the same maintainer, and later evolved to run inside CI pipelines and steal AWS, GCP and GitHub credentials.

Later activity linked to Shai-Hulud involved more than 25,000 malicious repositories created to publish stolen material, according to Tracebit. That pattern has added to pressure on maintainers and software suppliers to improve monitoring around continuous integration and release workflows.

How it works

Tracebit's approach uses canary credentials placed in a workflow's build environment, in locations where an attacker would typically search for real secrets. The credentials are genuine cloud credentials, but they have no intended operational use, so any attempt to use them is treated as a sign that a repository, build process or secrets store may have been compromised.

If those credentials are accessed and used, the system generates an alert. Tracebit said the alert includes context on the affected repository, workflow and run, giving maintainers a signal to investigate a potential compromise in their CI environment.

The company has also made Perimeter Sensors available to participants in the Open Source Program. These sensors imitate services an attacker might try to reach, such as a private npm registry, and issue canary credentials that work only against that imitation service. The aim is to provide another way to detect misuse of secrets in automated development workflows.

Early users

Docker, ClickHouse and Redis are the first named participants in the programme. Their involvement gives the launch early weight in the open-source ecosystem, where those projects are widely used across infrastructure, data and application development.

The programme also serves as a discovery mechanism. In exchange for unlimited canary credentials across their public repositories, participants agree to add the Tracebit badge to their READMEs, helping other maintainers find the service.

That requirement reflects a broader effort by security vendors to reach open-source developers through community-led distribution rather than direct enterprise sales. Open-source maintainers often manage issue triage, reviews, package publishing and dependency updates with limited resources, and security tools aimed at them typically need low-cost or free entry points.

Tracebit said it built the programme after making Community Edition available more broadly to users without a security budget. It identified open-source maintainers as a key audience because they sit at a sensitive point in the software supply chain, handling code, releases and the credentials tied to distribution.

Broader pressure

Security teams and software producers have paid closer attention to CI/CD environments following a string of incidents involving token theft, malicious package publication and attacks on trusted build systems. That has widened the scope of software supply chain security beyond source code review and dependency scanning to include monitoring for credential theft inside automated pipelines.

Tracebit's launch adds to that trend by targeting repository maintainers directly rather than only large software vendors. The offer is also notable because it removes repository limits for public open-source projects, suggesting the company sees broad usage as more important than restricting free-tier access in this part of the market.

Participants in the programme receive unlimited coverage for public open-source repositories and access to additional canary credential types through Perimeter Sensors.