diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 87c4900..1a003e8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,10 +20,14 @@ jobs:
           registry-url: https://registry.npmjs.org/
           cache: 'npm'
       - run: npm ci
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
         run: npm publish --access public --tag ${{ github.event.release.prerelease && 'beta' || 'latest' }}
+        env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
 
   publish-github:
     runs-on: ubuntu-latest
@@ -41,9 +45,12 @@ jobs:
           registry-url: https://npm.pkg.github.com/
           cache: 'npm'
       - run: npm ci
+      - name: Install ggshield
+        run: pipx install ggshield
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
         run: npm publish
         env:
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
           NODE_AUTH_TOKEN: ${{ github.token }}
diff --git a/.gitignore b/.gitignore
index bccf9ea..7a38e6e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,4 +47,5 @@ test/docs/*.mjs
 test/docs/sanity-report*
 *.log
 .nx/
-delivery-sdk-persistence/
\ No newline at end of file
+delivery-sdk-persistence/
+.cache_ggshield
diff --git a/.npmignore b/.npmignore
index 47e14fe..75952bd 100644
--- a/.npmignore
+++ b/.npmignore
@@ -19,4 +19,5 @@ src
 *.tgz
 .talismanrc
 tap-html.html 
-.github
\ No newline at end of file
+.github
+.cache_ggshield
diff --git a/package.json b/package.json
index d638cf7..caede19 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,8 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "prepare": "npm run build",
+      "postpack": "ggshield secret scan archive ./*.tgz",
+  "prepare": "npm run build",
     "test": "jest ./test/unit",
     "test:unit": "jest ./test/unit",
     "test:api": "ENABLE_HTTP_CAPTURE=true jest ./test/api",