GitGuardian Platform Reviews

My main use case for GitGuardian Platform is for security purposes when scanning our source repository, deployment, and all configurations where we can have credentials that cannot be shared with end users or any third party. This is why we are using GitGuardian Platform for security purposes to store all credentials securely.

In addition to the main use case, there are credentials we want to store for environment-related purposes. For production-related properties, we want to connect with Azure, Git, or some external APIs where we have secret API keys. We keep those in this secret management on Git so that we can secure our systems.

GitGuardian Platform's best features include automatically detecting issues in API keys, tokens, and passwords.

The automatic detection feature helps my team and workflow tremendously by saving a lot of time because everything is automatic now and we don't need to scan manually. This has saved considerable time and makes it easy to scan the whole project and find whatever issues exist.

Regarding additional features, the main focus was the ability to scan our project, CICD workflow, and other tools we are using to identify issues in the initial phases so that we can fix them easily and ensure our system has more comprehensive vulnerability scanning.

GitGuardian Platform has positively impacted our organization by helping to scan issues in early stages so that we can make decisions and fix them easily. It aids in automatic deployment whenever there is no vulnerability, allowing us to deploy our services without any impact or additional checks, thus saving a lot of time.

Earlier, when we had a security repository or CICD process, we were taking about four to five days to scan all those things and maintain documentation to reduce vulnerabilities and keys. However, with GitGuardian Platform, we have reduced that time to within a single day to perform all activities.

GitGuardian Platform is a better solution already, but we could enhance it further by incorporating more features using AI for better security scans instead of just offering guidelines.

For needed improvements, we could integrate with our source repository, whether it is GitHub, Bitbucket, or Git bucket, and we can do so easily using AI. We would just need to provide proper prompts to scan the whole repository, which could allow for fixing vulnerabilities during development before pushing to deployment.

I have been using GitGuardian Platform for the last two years.

GitGuardian Platform is reliable for us and has proven to be stable.

For scalability, GitGuardian Platform handles our requests very easily. We are a couple of developers working as a team, and we are using it at a high level without any issues related to scalability.

I have not connected with customer support yet because everything has been working fine.

Earlier, we were using some Git-related cloud tools for scanning, such as SonarQube for finding issues and fixing vulnerabilities. However, now we are using GitGuardian Platform, which is quite helpful.

My experience with GitGuardian Platform's pricing, setup cost, and licensing was straightforward. Everything mentioned in the document format was clear, and there were no issues.

We have seen a return on investment with GitGuardian Platform. The amount we spend yields full results whenever required, so it has been good.

Before choosing GitGuardian Platform, I did not evaluate other options. I was searching and found this platform to provide a better solution, which led me to utilize it.

I advise others considering GitGuardian Platform to proceed with it for integrating CICD tools, workflows, or source repositories, as it can help them in early development, ease their processes, and accelerate their workflow. I rate my overall experience with GitGuardian Platform as nine out of ten.

I mainly use GitGuardian Platform to monitor source code and repositories for exposed secrets and credentials. I identify leaked API keys or tokens and help prioritize and remediate those findings before they can be misused.

Recently, I used GitGuardian Platform to scan a repository, and it flagged an exposed API credential in the code. I reviewed the finding, verified where the credential was being used, removed it from the repository, rotated the affected credentials, and updated the code to use a secure secret management approach instead.

The best features for me are automated secret detection, repository monitoring, and clear alerts for exposed credentials. I also find the ability to prioritize findings and track remediation useful because it makes it easier to quickly identify high-risk secrets and ensure they are properly addressed.

The feature I rely on most day-to-day is automated secret detection and repository monitoring. It continuously helps identify exposed API keys, tokens, passwords, and other credentials across repositories, so I do not have to manually review every change for potential leaks. It is especially important in my workflow because I work with security testing and code review, and catching a credential early allows me to investigate and remediate it before it becomes a larger security issue.

GitGuardian Platform has improved our security posture by giving us better visibility into exposed secrets across repositories. It has also made my daily workflow more efficient because I can quickly identify, investigate, and remediate leaked credentials instead of relying entirely on manual code reviews. Overall, it has helped make secret detection a more consistent part of our deployment and security process.

One area that could be improved is reducing false positives and making it easier to quickly understand the context and severity of a detected secret. More detailed remediation guidance and additional customization for alerts and scanning rules would also make GitGuardian Platform even more useful for security teams managing a larger number of repositories.

I have been using GitGuardian Platform for the last nine months.

GitGuardian Platform is very stable.

GitGuardian Platform has been scalable for our use case. It works well with the number of repositories and code changes growing while continuing to provide visibility into potential secret exposures. This makes it suitable for teams that need consistent secret detection across a growing deployment environment.

Customer support is good.

My experience with the pricing and licensing was generally positive. The setup was straightforward, and I found the licensing model relatively easy to understand. The overall cost felt reasonable for the visibility and security value provided, although pricing can vary depending on the organization's requirement and scale.

I have seen a positive return on investment, mainly through time saved in identifying and investigating exposed credentials. GitGuardian Platform reduces the amount of manual effort required for secret detection and helps the security team respond to findings faster. I do not have a specific dollar amount or percentage to share, but the improved efficiency and earlier detection provide clear value in our security workflow.

I would recommend evaluating GitGuardian Platform if secret detection and credential exposure are important concerns for your organization. It provides useful visibility into repositories, helps identify exposed credentials early, and makes investigation and remediation more efficient. I would suggest starting with the areas most relevant to your deployment workflow and then expanding coverage as needed. I gave this review a rating of 10.

My main use case for GitGuardian Platform is secret detection.

Every time we open a pull request, it scans the pull request and ensures that we did not accidentally put a database password in a pull request. That process has worked very well for my team as it has caught several things, it is very helpful, and it is easy to use.

The best features GitGuardian Platform offers include notification directly to the engineer who created the pull request.

The direct notification feature has helped my engineers and my workflow overall by being effective. It is nice to know that no matter what happens, day or night, if someone puts up a change, they will get an alert, and the security team will get an alert.

GitGuardian Platform has positively impacted our organization as it helps us reduce the number of secrets that we would accidentally commit into source code. We have definitely saved time, as we do not have to go clean out Git history because we can just rotate the secret quickly.

I do not have real feedback on how GitGuardian Platform can be improved as I think the team does a good job.

I have been using GitGuardian Platform for four years.

My advice to others looking into using GitGuardian Platform is that it is a very quick win to set up and very easy to configure. I would rate this review a 10.

Our current use cases for GitGuardian Platform involve monitoring external and internal GitHub and GitLab, Bitbucket, and other code repositories that it supports for secrets.

The newest addition that we appreciate about GitGuardian Platform is the ability to create a custom detector, which we built and worked with the team, and that works very effectively.

GitGuardian Platform performs the capability to detect secrets in real time exceptionally, as it activates from the commit and can detect it immediately.

We utilize GitGuardian Platform's automated validity checks in some cases, and they seem to work effectively. We are still experimenting with them.

The multi-vault integration plays a key role in our secrets management strategy because we have multiple different vaults, and that works effectively.

GitGuardian Platform does what it is designed to do, but it still generates many false positives.

We utilize the automated playbooks from GitGuardian Platform, and we are enhancing them. We will probably stop using some of them, but we are building off of them. The one piece they do not include is contacting the person's manager or copying them, which we feel is necessary to prevent insider threat and other issues, but they do not have access to our hierarchy of employees.

We are not using the honeytokens feature of GitGuardian Platform.

Regarding improvements, there are two things we are working on with them. They have added charts, which is a new feature, but it is still not accurate. It has taken 4 to 5 months and it is fairly slow. We are looking for better metrics and audit data, wanting more features such as knowing which users are creating the most secrets or committing the most secrets, what repository, what directory, and who is not checking in secrets, which repo, user, or directory has not had any secrets committed. We want more metrics around both good and bad to see how we are performing.

I have been using GitGuardian Platform for 5 years at the company, and my team has been using it for 3 years.

There has not been any instability with GitGuardian Platform; it performs reliably.

Currently, what GitGuardian Platform is doing works effectively. It is quick and meets our needs. If we added more, I do not think that would really impact performance, so the scalability in that aspect is fine. I know they are trying to branch out and look for secrets in other types of tools, but I am not sure if we are going to use them for that or if that would impact performance or stability either.

I have contacted technical support previously, but we usually work through our customer representative directly, and they create the tickets for us.

We have one employee that primarily works on the deployment and configuration of GitGuardian Platform, and that took approximately a couple of weeks working directly with them. After that, she spends about an hour in there a week, so it requires minimal effort on our side.

GitGuardian Platform requires very little maintenance on our end—just making sure the keys are connected and ensuring people are following through.

I have not used any alternatives to GitGuardian Platform in this specific scope, as I have not found one that fully integrates into as many different code repositories. We have used a couple of tool-specific ones, but GitGuardian Platform is the only one we have used that works across multiple platforms.

We purchased GitGuardian Platform for a compliance checkbox because we needed to monitor secrets in our code repositories. We saw benefits immediately after implementation, but the reason my team took it over after a couple of years is that the original team did not really go beyond a compliance checkbox. We started seeing benefits in year 3 as we built out a workflow to contact the developers who committed code with secrets and get them to review and approve or revoke the process.

In terms of how GitGuardian Platform Public Leakage Detection influences our data security, it helps us with our known developers, but it is fairly limited. It has to go to another developer who has to make it public or they have to put codes in there, so it works in the right scenario, but there are scenarios where it still misses.

We do not really look at the automated security severity scoring in Incident Management. We still are getting false positives and others, so we are concentrating more on that versus any severity rating.

The pricing for GitGuardian Platform is fair, though slightly high.

We are customers of GitGuardian Platform; we do not have any partnerships or official partnerships, nor are we resellers.

I rate GitGuardian Platform 8 out of 10.

My main use case for GitGuardian Platform is for secret detection in the code base, whether in the actual files or in the history of the GitHub code, helping me determine if there are, or were at any point, hard-coded secrets like API keys, passwords, or certificate key stores, and whether they are valid or false positives that require immediate remediation or remediation later on.

There was a specific time when GitGuardian Platform helped me catch something important, as it detected a couple of secrets that were still used in a project that had been migrated. We discovered in the history that while the current files contained no hard-coded secrets—everything had transitioned to using Secrets Manager—GitGuardian Platform identified two valid secrets in the GitHub history that needed to be deleted, although they were not critical or dangerous. To be on the safe side, we changed those secrets after ensuring they were properly removed from the history.

I have nothing else to add about my main use case or how I use GitGuardian Platform day-to-day. It is nice how it automatically scans whenever there is a commit in the GitHub repository, and even when a commit is deleted, the ID of the commit remains visible but grayed out, as it doesn't exist anymore. I would mention the validity check for public API keys is very useful while monitoring the security score. One limitation I've found is that as the tool progresses and updates, it may detect older secrets that have already been resolved, so it would be helpful to get notified when that occurs. Another significant limitation we've encountered is when the same secret is present in multiple repositories managed by different teams; we cannot close the incident unless both teams communicate and agree, because closing is applicable to all repositories, which is challenging when teams don't know each other.

GitGuardian Platform has positively impacted my organization by making the team extra careful about committing hard-coded passwords, even if they are just for testing purposes and deemed invalid. Additionally, my team has started integrating GitGuardian Platform on their local VS Code to scan before pushing code. It has also encouraged the habit of rotating old secrets that were at one point flagged in the tool.

I haven't noticed a reduction in security incidents, as we don't have many because we prioritize security in our development cycle. However, I can say that GitGuardian Platform helped us clean up our GitHub repositories of any type of secrets, even the useless ones, ensuring that if someone were to gain access, they wouldn't know what our API key or password looks like. It has especially helped us eliminate valid secrets from our repository histories, and we currently have zero valid secrets left.

The best features GitGuardian Platform offers include secret detection regardless of the commit history, which means it can detect both current and older files. Its ability to check the validity of API keys is crucial, and it allows tracing of actions regarding secrets—whether they are marked as false positives, invalid, or if remediation is necessary. Additionally, it facilitates the use of tools such as Slack or Teams for notifications.

I find myself relying the most on the instant scan of passwords offered by GitGuardian Platform, as it accurately checks for real secrets and does not mistake common words such as 'password' as a secret. This is advantageous compared to other tools that increase the rate of false positives significantly, which often occurs with keys that are merely for testing or are invalid.

Regarding improvements for GitGuardian Platform, the secret detection feature needs upgrading as it opens only one common issue for the same secret detected in multiple repositories. This poses a challenge, especially if two teams in different repositories, who don't know each other, are working with the same hard-coded secret. Team A cannot close the ticket independently because they are unaware of how Team B is using that secret. It would be much more effective to have a parent ticket for the secret that contains child tickets for each repository, allowing each team to manage their status for that secret as they see fit.

The reason I chose a nine or nine and a half is due to the pain points I've mentioned, particularly the challenges when validating secrets. Additionally, I prefer being notified whenever a new secret is detected in the GitHub history.

I have been using GitGuardian Platform for almost two years.

GitGuardian Platform is very stable, with no downtime or issues in my experience.

The scalability of GitGuardian Platform has met my organization's needs as we have grown or changed, and I did not notice any difference.

Previously, we used the password detection feature in Checkmarx, but we switched because we found it unreliable. Checkmarx often flagged many false positives, sometimes misidentifying the word 'password' as a real password or mistaking names of secrets in Secrets Manager or Key Vault for secret values. Their lack of capability to detect hard-coded passwords in the GitHub history was another issue compared to what GitGuardian Platform offers.

I have seen a return on investment, particularly in securing the applications and ensuring there are no hard-coded secrets within the code base, which is a significant security positive.

I haven't had the chance to thoroughly explore GitGuardian Platform's AI capabilities, so I'm not sure how I can answer that. Regarding my experience with the accuracy and reliability of GitGuardian Platform's AI capabilities, prior to their implementation, I found them to be helpful, especially in deciding the severity of a password when evaluating its risk from someone outside the application. My advice for others considering GitGuardian Platform is to move forward with it, as it's a great tool. I would rate GitGuardian Platform overall at nine, or nine and a half.

My use case for the GitGuardian Platform is application security for our enterprise repository.

The solution has improved our organization. We are still in the rollout, but the users who are utilizing it are very happy, especially about the feature that enables pre-commit hooks in Git that will not raise to the remote repository. This is a very good feature that our developers use very heavily.

The best features of the GitGuardian Platform are that it finds many different secrets, more than other competitors, and the support from the colleagues is also very good.

The GitGuardian Platform helps in monitoring and protecting our code repositories from leakage. It helps significantly because we connected our vulnerability management process to this, and the colleagues from vulnerability management have much easier work since we have the GitGuardian Platform installation due to the dedicated incidents or issues which are opened automatically.

The alerting capabilities and threat intelligence features of the GitGuardian Platform are managed by another team; we only host the platform.

The audit logs and compliance reports from GitGuardian are very helpful because, in the past, we needed to do it manually by scanning the repos. Now with GitGuardian Platform, we have a really good overview of what is open, what is closed, and how critical the issues are.

The areas that have room for improvement involve the missing feature to add custom detectors for the GitGuardian Platform, which would help us check if internal secrets are still valid or not.

I assess the accuracy of the detection from the GitGuardian Platform as very good because we don't have many false positives, which means the quality is very good. The only thing we want to have are some additional detectors which help us to prioritize, especially since enterprise secrets are found, but they cannot verify if they are valid or not.

I have been using the GitGuardian Platform for one and a half years.

The stability of the GitGuardian Platform is excellent. We don't have any problems with the stability of the system at all.

The scalability of the GitGuardian Platform is excellent.

The technical support from the GitGuardian Platform deserves a rating of nine out of ten.

The deployment of the GitGuardian Platform is very easy because it's a Helm chart which is very easy to install for us. The deployment took several days.

I have no information about pricing, but since they won the request for quotation, I believe it's a good price.

We created a technical evaluation and checked against other providers, though I don't remember the names. The GitGuardian Platform has the best technical capabilities, and our procurement handles the pricing part.

The GitGuardian Platform is used worldwide in our environment.

Currently, we have approximately 1,300 licenses for the GitGuardian Platform, but we will increase to 2,000 next year.

The solution requires maintenance from our side only for user management, which is normal for each application.

I cannot quantify how much time or resources the GitGuardian Platform saves us because this is spread across all teams worldwide.

I would recommend the GitGuardian Platform to other users because the integration with GitHub and Azure DevOps is very easy, and you also have the possibility to use it locally on your IDE. This is a very good solution.

I rate the GitGuardian Platform a nine out of ten because room for improvement is always possible, but it's really good.

We initially integrated GitGuardian Platform into our organization in 2023 into our GitHub repository. We implemented it because we did not want our secret credentials to be exposed to the internet or to a third party such as GitHub. It flags when credentials have been exposed so we can remediate and fix them. GitGuardian Platform was what my tech lead suggested we use, and we had to incorporate it into our repositories. We use the Platform version.

What I appreciate the most about GitGuardian Platform is its efficiency when triggering our pipeline and notifying us if secrets have been exposed, such as APIs, variables, our database, or anything being exposed. Currently, we have numerous repositories and pushes that happen in our repo. It would be humanly impossible for us to manually search for these secrets. GitGuardian Platform can do this automatically. All we need to do is wait for an email notification that indicates a secret has been exposed. It points out the repository that has the secret exposed, and we can fix it. This saves us the time of manual review.

The main disadvantage I feel they should improve upon is that apart from flagging credential issues or secrets, they could incorporate something else to make it more dynamic. If their product focuses majorly on secrets leaking, similar to Amazon Macie, they could expand their capabilities. Amazon Macie primarily flags secrets being exposed over the internet.

For example, we use Dependabot for code review. Dependabot helps us follow best practices such as code quality and code analysis, as we cannot manually check 10,000 lines of code to ensure they follow structural standards. If GitGuardian Platform could incorporate code analysis into their system, not just for secrets alone, it would make them more dynamic.

This would allow users to have just one tool instead of multiple third-party tools running in GitHub. It would reduce management overhead as you wouldn't have to manage multiple tools.

I have been using GitGuardian Platform in my career for almost two years now.

For my organization, GitGuardian Platform has been stable. Since installation, we haven't had to optimize it, and I am unsure about new versions. It has been functioning effectively, and its performance is satisfactory. The only limitation is that it performs just one task. While it is efficient at credential flagging, it could offer more functionality.

Regarding scalability, in my organization, we have about 44 repositories running, and GitGuardian Platform has been able to handle these repositories efficiently. I am uncertain about its capability to handle 100 repositories. For our organization, which is just four years old and not a large platform with numerous features, it functions adequately with our 44 repositories.

Some tools can function properly until demand increases or usage reaches a certain extent, at which point they might start deteriorating. For instance, with our GitHub account, we had to pay for more capacity usage. I am unsure if GitGuardian Platform has similar limitations on the number of repositories it can handle. However, for our current 44 repositories, it has been working exceptionally.

I have never contacted any technical support or customer support through phone or ticket system. We have never experienced any issues with it. It effectively helps us with credentials security and has been performing satisfactorily.

Neutral

I have not compared GitGuardian Platform with any alternatives in my organization. For GitHub repositories credentials, we use GitGuardian Platform. For AWS, we use Amazon Macie because we run our infrastructure on Amazon Web Services. We use Macie to protect our credentials from being exposed.

The initial deployment and installation was very easy for us.

For this deployment, my tech lead handled the implementation. We were on a call with him while he deployed it. It required only one person to complete the setup.

It does not require any maintenance on our end as it has been working autonomously. I am unaware of new versions, but what we have been using has not required maintenance.

I am not involved with the pricing of GitGuardian Platform, as the tech lead handled those aspects. Initially, I thought it was an open-source tool. There are private and public versions available. The private version requires payment, but for the public version we use, we did not make any payments.

I have not compared GitGuardian Platform with any alternatives in my organization. For GitHub repositories credentials, we use GitGuardian Platform. For AWS, we use Amazon Macie because we run our infrastructure on Amazon Web Services. We use Macie to protect our credentials from being exposed.

I will rate GitGuardian Platform a seven out of ten. The reason for this rating is that I wish they could have an agent embedded into their system that helps to identify real credentials from mock credentials, as this sometimes causes false alarms.

We are users of the product with no partnerships with GitGuardian Platform. They can contact me regarding any questions about this review. I am open to anything that benefits the community and makes everything better.

My main use case forGitGuardian Platform is secrets monitoring across public repositories and internal codebases. I use it to detect anything that matches keywords or signatures — particularly system secrets, tokens, and credentials that may have been accidentally exposed. When GitGuardian flags a potential exposure, I reach out to the responsible parties to ensure the secret is rotated and the risk is mitigated.

Security operations is the main use case for GitGuardian Platform, and we are using it in security operations as one of our large use cases.

GitGuardian Platform has had a significant positive impact on our organization. It has helped us uncover a number of exposed secrets, including critical tokens and credentials that were accidentally pushed to repositories. Without it, these exposures could have gone undetected and led to serious security incidents. Overall, it has meaningfully strengthened our secrets management posture.

The best features GitGuardian Platform offers include secret incidents, activity, push events, and commits. The specific features that stand out to me as the best on GitGuardian Platform are the seamless integration capabilities and the incident detection capability that detects passwords and any high-entropy secrets, as well as the feature that allows us to segregate, flag, assign, and manage incidents.

The incident tracking, seamless integration, and search functionality are all part of what makes it great.

GitGuardian Platform is already a mature and well-rounded product. The features, user interface, and integration capabilities all meet our needs effectively. At this point, I do not have any specific improvement requests — it does what it promises and does it well.

I have been using GitGuardian Platform for four and a half years.

Yes, GitGuardian is stable. In four and a half years of usage we have not experienced significant downtime or reliability issues.

GitGuardian scales well for our security operations needs. It handles monitoring across our repositories without performance issues.

Customer service and technical support have been satisfactory for our needs.

No, I did not previously use a different solution for secrets monitoring. GitGuardian was our first dedicated platform for this use case.

The initial setup was straightforward. Integration with our existing systems was seamless with minimal configuration effort.

No

Yes. The platform flagged secrets and tokens that were accidentally pushed publicly

I am not involved in pricing discussions

We did not evaluate other solutions extensively before choosing GitGuardian. It met our requirements for secrets monitoring and security operations out of the box.

I would rate GitGuardian Platform a seven out of ten because I appreciate it; it is not the best tool, but it is above other tools. Regarding GitGuardian Platform's AI capabilities, I think it is secure, and it could benefit from using AI systems for security purposes. I find the accuracy and reliability of GitGuardian Platform's AI output to be on point.

We use the GitGuardian Platform for internal security monitoring. Initially, we employed it to identify any secrets from our internal repositories that might have been accidentally exposed publicly and then expanded our use of GitGuardian to remove secrets from our private repositories, also.

Our company has grown through acquisitions. To address this complexity, we've integrated GitGuardian with our development teams. This allows them to identify secrets within any repository so they can be quickly remediated, ultimately enhancing the security of our codebase.

GitGuardian helps us prioritize remediation quickly. The alerting component is helpful because it lets people know immediately when something suspicious appears. Additionally, the code context feature is valuable as it shows developers exactly where the issue occurs in their code. They can even click a link to jump directly to that location in GitHub. These features significantly speed up the process for developers to identify and remove vulnerabilities.

GitGuardian effectively supports a shift-left security strategy. This is because it integrates directly with the code repository, allowing for near real-time feedback on potential security issues before code is merged into production branches. This early detection is highly valuable. Furthermore, GitGuardian's command-line interface provides another layer of convenience. Developers can proactively search for and address security concerns before pushing their code.

GitGuardian improves collaboration between our developers and security teams on remediation efforts. The centralized dashboard is tremendously helpful for managing across a multitude of teams and hundreds of engineers. It allows me to see the progress of each team. This visibility makes it much easier to communicate with them. For instance, I can identify teams that might need assistance or recognize those that are successfully reducing vulnerabilities.

GitGuardian has dramatically improved our ability to detect secrets by shedding light on previously hidden vulnerabilities.

Our security productivity has increased significantly. Simply by making this information readily available to developers, we've empowered them to take action. Previously, this wasn't easy, especially when dealing with inherited legacy code. Developers often wouldn't know where these secrets were hidden within the codebase. This improved visibility has made security issues much more actionable for our developers.

With over 6,000 repositories, GitGuardian's automation capabilities have saved us many months of research.

GitGuardian has reduced our mean time to remediation. This ability to track security issues and communicate proactively with teams undoubtedly means we can also remediate them faster.

Recently, a new feature was added that I had been requesting for a while, and I'm super excited about it! This feature allows us to filter incidents by team within the available filters. This is incredibly helpful because before, we could only search for individual repositories. Some of our teams have hundreds of repositories, so filtering by team saves a lot of time and effort.

The ability to create teams is also valuable for a large organization like ours. Some vendors struggle to provide enough user organization layers, but GitGuardian excels in this area.

The core incident management features are also fantastic. For example, alerting people via email about new incidents is crucial for staying on top of things. Additionally, the dashboard allows users to mark the status of secrets, providing a convenient location to review everything.

Another area where GitGuardian shines is the breadth of secret types it covers. They can identify a vast number of secrets out-of-the-box, with minimal false positives. This means they effectively distinguish real secrets from irrelevant data, saving us time and effort. I also appreciate the context provided for developers. When they investigate secrets, they can see exactly where those secrets reside in the code, allowing for quick fixes.

While they do offer some basic reporting, more comprehensive reporting would be beneficial in the long run. This would allow me to demonstrate the value of the product over time to continue to effectively budget for this subscription, especially as they add features that may come at an additional cost. I appreciate the improvements made to reporting over the past year, but continued development in this area will be appreciated.

We have encountered occasional difficulties with the Single Sign-On process. There is room for improvement in its current implementation. It works, but was not quite as smooth as the rest of the GitGuardian experience.

I have been using the GitGuardian Platform for one year.

GitGuardian is stable. I have not had any problems.

GitGuardian scales incredibly well. We bombarded them with a massive number of repositories, and they ingested everything much faster than I anticipated. This allowed for a swift evaluation process. Their ability to handle large deployments is evident, and I'm confident they support companies even bigger than ours.

The technical support team responded quickly and was able to resolve my issues the following day. There were no problems with their service.

Positive

Before implementing the GitGuardian platform, we lacked a solution to identify secrets in our code. This created a significant security blindspot for us.

The initial setup was straightforward. However, we did need to establish the initial connection between the repositories. This process went fairly smoothly overall. While connecting the repositories on GitHub was easy, it was a bit trickier on the Azure side. So, some preparatory work was required there. Once that was done, the internal monitoring setup was complete and went quickly. Additionally, we had to set up teams and invite members, but this also went quickly.

The deployment took a couple of days. The repository connections (6,000+ repositories) took an hour or two to fully populate. One person was required for the deployment. 

The implementation was completed in-house.

GitGuardian is not inexpensive. It's one of the more expensive tools in our portfolio, especially considering its focused functionality. However, while it may not offer a wide range of features, it acts as a form of critical security insurance. It safeguards our most vulnerable points, and a data breach can lead to legal repercussions that can be very costly for years to come. In that light, the cost is warranted and rational.

After considering several options, we determined that GitGuardian was the most robust solution for our organization's needs.

We evaluated several open-source solutions for secret detection. We also considered other security tools with similar capabilities but found that those not specifically focused on secret detection fell short. These tools often treated secret detection as an afterthought, resulting in limited effectiveness. While they might identify some basic secrets, they lacked the depth and comprehensiveness of GitGuardian. This is why we decided to invest in a dedicated secrets detection tool.

I would rate the GitGuardian Platform 10 out of 10.

Concerning maintenance, there may be a rare exception that we need to enter into the platform when new repos are added, but these have been very infrequent. The tool requires very little ongoing maintenance, beyond what teams need to triage.

While there are open-source secret detection tools available, they can be limited. GitGuardian, with its dedicated development team, offers a more comprehensive solution. Their support, including responsive sales reps and customer service, ensures you get the help you need to keep your system secure. Open-source solutions often lack this level of dedicated support, which can leave you troubleshooting issues on your own. For critical security needs, the additional features and support offered by GitGuardian are a worthwhile investment.

It's critical to our application development security program to have a robust secrets management solution. This is especially important when we have a large development team. In such an environment, the risk of human error increases, often due to unintentional mistakes. People might forget things, miss something during development due to time pressure, and so on. However, even a single mistake can have serious consequences. Therefore, careful management of secrets is essential. It safeguards our relationships with vendors, protects our internal data, and offers numerous other benefits.

My recommendation is to prioritize setting up SSO as first step, before onboarding any other users, if you're planning to implement it. Do it first. That was the only real challenge we faced; trying to get it working later created some complications. The actual setup process of getting GitGuardian to scan our repositories was straightforward and fast.

We brought in GitGuardian Internal Monitoring to review all of our code within GitHub so that we can identify and fix any exposed secrets.

I have been very impressed with the breadth of its detection capabilities. I did a proof of concept with a couple of other common tools for the same kind of thing, and I found GitGuardian to be the best. It finds everything that I would expect it to find. It found more than I thought we would find, so I am very happy with the detection.

I am very happy with the number of specific detectors and keys that it can find for Google, AWS, Twitter, Facebook, etc. It has a lot of specific detectors for different categories, but it also has quite a lot of automatic validity checking, so it can tell whether your Twitter keys or AWS keys are active and or have been revoked. If they are revoked, it is not a problem. Validity checking is fantastic.

GitGuardian Platform's accuracy is incredibly high. There are a couple of categories of generic secrets that I can find. When you turn those on, you end up with quite a few false positives. With the specific detection categories, the false positive rate is incredibly low, but when you turn on the generic categories, it goes up a bit. I am very happy with the number of things that it does find, instead of focusing on true positives versus false positives.

It has not helped to decrease false positives because we did not have a tool in the first place, so we did not have any false positives. We have not decreased our rate at all.

GitGuardian Platform has absolutely helped to quickly prioritize remediation. The severity or criticality that the tool automatically assigns has been very helpful. The built-in validity checking has also been helpful. Whenever you have keys that are marked as valid within the tool, you know that they are high priority and need to be resolved sooner than the ones that are not marked as valid.

We have significantly reduced our potential risk exposure of secrets. In the past nine months, by using GitGuardian, we have been able to identify and resolve a large number of secrets within our code, which reduces the risk if our code were to become public. It has greatly reduced our security risk. It has reduced the potential risk of exposure of secrets by about 75%. We have not only been able to resolve existing issues; we are also more likely to prevent these issues from occurring with improved security culture and the features within the tool.

GitGuardian Platform efficiently supports our shift-left strategy. It provides a command line interface, which can link with the shift left with your standard development processes. Whenever developers are writing code and trying to commit and push that up to GitHub, the command line interface can be integrated into that to prevent secrets from getting into GitHub. It can help go almost as far left as possible.

GitGuardian Platform has greatly improved awareness, and it has reduced the number of secrets that end up in our code. There has been a two-layer impact where it has helped people think about this as an issue and it has also helped them stop doing it even if they are not thinking about it.

GitGuardian Platform has improved our ability to collaborate. We work closely with the development teams to identify the issues, investigate the issues, and troubleshoot and resolve those issues. Due to the way the tool works, it has helped us gather people into teams and work with them so that we can help resolve the findings.

We have one or two of the playbooks automatically enabled. So far, I find them very helpful. The main one so far is that the secrets will automatically resolve when they are revoked, which is incredibly useful. For example, whenever someone goes into the AWS platform to revoke AWS keys, they do not have to go into GitGuardian. It automatically detects that they have been revoked and closes the issue. It is a lot less work than having to go into two different tools and more. There are a couple of playbooks we have for the CLI, so whenever we ignore issues via CLI because something might be a false positive or something might only be a testing key, it will auto-resolve within the UI. The playbooks make it easier to avoid using the UI, but you do not have to. It is one of the catch-22 situations. There is UI, but they are enabling you to not even have to check it in the first place. Playbooks have reduced 50% to 60% of manual work. If developers accidentally commit active keys, they do not have to go in. They do what they need to do to resolve the keys. They do not need to think about it again.

GitGuardian Platform has increased our security team's productivity by about 50%. When we previously had noticed keys, it would have been manual. It would only have been occasionally when I was looking through the code and found the keys. I would have had to reach out to developers and discuss that. It has definitely greatly increased our productivity because we can now automate sending out tickets and assigning them to the right teams. A couple of clicks can send out the information for someone to look into rather than having to message them and try to discuss it with their team. It is a lot more automated.

It is hard to measure the increase in secrets detection rate because previously, we did not have any solution, so we were not detecting anything. After implementing GitGuardian, we can now see what we have got.

Similarly, it is hard to measure the reduction in the mean time to remediation as we did not have something before. It was more manual before. There is probably a 70% reduction because, previously, if I found an issue, I would reach out to our team and spend a while discussing it with them, whereas now, we can just send out a Jira ticket. They can log in and have a look. There is a lot less discussion back and forth.

There is quite a lot to like. Its user interface is fantastic, and being able to sort the incidents by whether they are valid or for a certain repository or a certain user has been very beneficial in helping investigate what has been found. 

The CLI provided by the tool is fantastic for preventing the secrets from getting into GitHub in the first place. The more you use the CLI, the less you use the user interface.

Automated Jira tickets would be fantastic. At the moment, I believe we have to go in and click to create a Jira ticket. It would be nice to automate.

I believe there is a feature on the road map for better handling of issues that have over one occurrence. It is difficult to investigate when there are a large number of secrets. It is hard to know where they are and what to do. These two things would be nice.

I have been using GitGuardian Internal Monitoring for about nine months.

It is a stable solution. I have not noticed any issues with performance, downtime, or anything like that. I would rate it a ten out of ten for stability.

It is scalable. All it requires is someone with GitHub admin permissions. We can integrate as many repos and sources as we want. I would rate it a ten out of ten for scalability.

We have 316 users using this solution. We plan to increase its usage. There are a couple of features in GitGuardian. There is a feature where CLI integrates with your development process for pre-commits. We plan on testing and rolling out that feature so that every developer has pre-committed automatically enabled on their machine. The idea is that it will basically prevent any secrets from getting into GitHub. Another, a lot more minor, feature is GitHub pull requests. Every time there is a pull request, the GitGuardian bot will comment on it if there are secrets. There is an option to block the pull request when secrets are found. We plan to implement that as well.

Their technical support so far has been fantastic. Anytime I raise a ticket, it is resolved and answered very quickly. I am very impressed. Their support is incredibly knowledgeable. Whenever I have questions about detection or remediation, they are very detailed in their answers, and they clearly know a lot about the tool.

Our experience has been fantastic with the purchase, the onboarding, and the customer success team. Everything has been straightforward. Everyone so far has been nice, friendly, and helpful. When there were any hurdles, they helped me resolve them straight away. I would rate their support a ten out of ten.

Positive

We did not use any similar solution before. It was a manual process. We did not monitor anything. We just occasionally noticed things to be resolved. It was a manual process.

To implement it, the only thing required from our side was having someone with admin permissions to enable the installation. It was minimal from our side.

It does not require any maintenance from our side.

It required just one person with GitHub admin privileges. I clicked a few buttons, and then he went in and approved it, and that was it.

It has definitely saved us a lot of time. To be able to view everything important and narrow our focus to resolve issues has sped up our development process and decreased our security risk.

I am only aware of the base price. I do not know what happened with our purchasing team in discussions with GitGuardian. I was not privy to the overall contract, but in terms of the base MSRP price, I found it reasonable.

We reviewed three or four main secret detection products available. We reviewed GitHub Advanced Security and BluBracket.

We chose GitGuardian for a number of reasons. Its user interface is absolutely fantastic. Being able to filter instances has been the main thing. It helps us to focus and narrow down our remediation efforts.

There is also the ability to create teams and assign developers and teams to only see what they are responsible for. There are a number of other products, but they are missing that feature of narrowing visibility. We wanted a tool that the security team could set up and the developers could log in to use. A lot of the other tools on the market are only for the security team. It would have been more manual on our side to reach out to teams to get them to resolve things. This way, we can add users to teams, assign them the repositories that they maintain, and they can work away by themselves.

To a security colleague at another company who is using an open-source secrets detection solution, I would be happy to recommend GitGuardian. I have been setting up and using the tool. I can happily, personally, and professionally recommend this tool to others.

In my opinion, secret detection is incredibly important to a security program for application development. It is critical to our company's obligation and security process. Without it, you do not know what secrets could be leaked, so once you implement it, you know where you stand and you know what you need to do. You can resolve as well as prevent these things.

I would definitely recommend doing a proof of concept to make sure it fits your use case. I would be more than happy to recommend it. There would not be any caveats. Go ahead and test it out. If it fits exactly what you need, go for it.

Overall, I would rate GitGuardian Platform a ten out of ten. I am very happy with what we are able to do with it and how it works.