Case Study: GitGuardian achieves secure multi-user AI agent access with WorkOS

GitGuardian uncovers 24,008 secrets with WorkOS

GitGuardian faced a significant security challenge when building multi-user applications with the Claude Agent SDK. The standard implementation meant every user's agent ran on a single shared token, creating a severe risk where one user could access another's sensitive data from integrated platforms like Jira, Slack, and HubSpot. This was not a hypothetical issue, as their own research found thousands of exposed secrets in public code repositories. They needed a secure way to bind each tool call to the individually signed-in user.

WorkOS provided a solution using its AuthKit for user authentication and identity resolution and its Pipes relay service to securely make API calls on behalf of each user without their tokens ever entering the application's runtime. This ensured each agent could only operate with the permissions and access of the specific user who initiated the request, effectively eliminating the cross-user data access risk. The implementation also integrated with WorkOS Audit Logs to create a reliable record of actions taken under each person's name, not a shared service account, providing crucial accountability.

GitGuardian