GitGuardian Platform Reviews

One specific example of how my team has used GitGuardian Platform to catch an issue was when it detected an API key that had accidentally been committed to a repository; we were able to quickly identify the exposed credential, revoke and replace it, and then clean up the repository so that the secret wasn't left exposed.

Day-to-day, we mainly use GitGuardian Platform as an additional security layer around our development workflow, helping us continuously monitor repositories, investigate alerts, and work with developers to remediate exposed secrets before they become larger security issues.

GitGuardian Platform has positively impacted our organization by improving our visibility into credential exposure and reducing the time it takes to identify and respond to leaked secrets; it also gives developers earlier feedback so security issues can be addressed closer to the source instead of becoming larger incidents later.

We haven't tracked a formal percentage for response time improvement since using GitGuardian Platform, so I wouldn't want to give an artificial number; practically, alerts have helped us move from discovering exposed secrets during reviews to identifying them much closer to when they are committed, often within the same working day.

The best features GitGuardian Platform offers are secret detection and real-time monitoring, which are probably the most useful for us; I also appreciate the alerting and incident investigation capabilities because they make it easier to trace when a secret was exposed and coordinate remediation with the development team.

The real-time monitoring and alerting features of GitGuardian Platform have significantly helped my team respond to incidents; for example, the alerting has helped us catch exposed credentials shortly after they were committed rather than finding them during a later security review, and in one case, the team was notified the same day, allowing us to revoke the key, replace it, and clean up the repository before it caused any downstream impact.

Another useful aspect of GitGuardian Platform is the visibility it provides to security and development teams into secret exposure across repositories; the remediation workflow and historical context around alerts are also helpful when investigating whether a credential is still active or when determining immediate action.

One area for improvement in GitGuardian Platform would be reducing false positives and making alert prioritization even more precise for larger environments; more customization around notifications and remediation workflows would also help teams avoid alert fatigue as the number of repositories grows.

Regarding improvements needed for GitGuardian Platform, I would appreciate more flexibility in integrations, especially with different DevOps, ticketing, and security tools used across enterprise environments; while the UI is generally easy to use, better customization of dashboards and alert views would make it easier to manage a large number of repositories.

I chose eight out of ten for GitGuardian Platform mainly because there is still room for improvement in enterprise integrations and customization; for larger environments, better alert prioritization, dashboard flexibility, and integration with more DevOps and security tools would strengthen the overall experience.

The main areas we discussed primarily cover everything, but beyond those, I would appreciate more granular role-based controls and easier customization of alert workflows, especially for larger teams where different groups may need different levels of visibility and access.

I have been using GitGuardian Platform for a little over a year, primarily to monitor our code repositories for exposed secrets and credentials, and to help the development teams identify and remediate potential leaks early.

In my experience, GitGuardian Platform has been stable during the time we have used it; we haven't encountered major availability or reliability issues, and the monitoring and alerting generally work consistently as part of our development workflow.

So far, GitGuardian Platform has scaled well as we have added more repositories and development teams; the cloud-based model makes it relatively easy to expand coverage without managing additional infrastructure, although larger environments require good alert management and configuration.

The customer support experience with GitGuardian Platform has been generally good for the issues and configuration questions we have raised; responses have been reasonably clear and helpful, though response times can vary depending on the complexity of the issue.

I would rate customer support for GitGuardian Platform eight out of ten, as the team has generally been responsive and helpful, especially for configuration and troubleshooting questions; however, there is some room for faster responses on more complex issues.

We previously relied more on built-in repository scanning and manual checks rather than a dedicated secret management monitoring platform, and we moved to GitGuardian Platform because we wanted centralized visibility, more consistent detection across repositories, and faster alerting and remediation workflows.

We haven't calculated a formal dollar ROI or headcount reduction with GitGuardian Platform, so I would not want to put an artificial number on it; the main day-to-day benefit is that secret detection and initial investigation are automated, saving developers and security teams time and allowing them to focus on remediation instead of manually checking repositories.

From my experience, the pricing of GitGuardian Platform felt reasonable for the security coverage and visibility we get; although the overall cost depends on the number of repositories and users covered, setup was relatively straightforward, and licensing didn't require a lot of operational overhead once the initial configuration was completed.

Before choosing GitGuardian Platform, we looked at a few alternatives, mainly GitHub Advanced Security and GitLab's built-in security capabilities; we compared them based on secret detection coverage, alerting, integrations, and how easily the solution could fit into our existing development workflow.

I would rate GitGuardian Platform eight out of ten; it has been reliable for secret detection and monitoring, with good visibility and useful alerting, although there is still room for improvement around integrations, customization, and alert management.

Regarding the AI capabilities of GitGuardian Platform, I find them useful when they provide more context around detected secrets and reduce manual investigation; from a governance and security perspective, I still want clear controls around data access, privacy, auditability, and how AI-assisted analysis is used within our organization.

I found the AI-assisted analysis of GitGuardian Platform generally useful for adding context to security alerts and helping with investigations; however, I still treat the output as a supporting signal rather than the final decision, especially for higher-risk findings where we validate the details before taking action.

We deploy GitGuardian Platform as a public cloud SaaS solution that integrates with our development and source control workflows, meaning there is no separate on-premise infrastructure required for the platform itself.

We use GitGuardian Platform as a SaaS platform and do not directly manage or choose the underlying cloud provider for the deployment; from our side, we primarily interact with the GitGuardian hosted service and integrate it with our development tools.

My advice for others looking into using GitGuardian Platform is to first identify which repositories, teams, and secret types you need to monitor, then set up the integrations and alert workflow around that; also, spending some time tuning notification and remediation processes early on makes the platform much more useful as your environment grows. I rate this product eight out of ten overall.

My use case for the GitGuardian Platform is application security.

My impression of the GitGuardian Platform's capability to detect secrets in real time is actually really amazing, because it lets us protect or block the pipelines in which we deploy new applications so we can acknowledge when a secret is hardcoded in a repository, or when we have already hardcoded secrets within templates in our repos.

We adopted it a year ago, and it has been doing great in our teams, especially for developers. The impression so far has been good.

The severity scoring has helped us in incident management because it is doing the correct job. We got many secrets leaked within our platform and it was making the correct warnings regarding that particular secret, as we had a hardcoded Google Cloud API key. It was marked as a critical severity, so we had the chance to correct it, regenerate that secret and work again on not hardcoding secrets within our code.

GitGuardian's public leak detection significantly enhances our organization's data security by continuously monitoring public repositories. It allows us to proactively identify accidental exposures of sensitive credentials or secrets.

Regarding the exceptions in GitGuardian Platform, we know that within the platform we have a way to accept a path or a directory from a repository, but it is not that visible at the very beginning. You have to figure out where to search for it, and once you have it, it is really good, but it is not that visible at the beginning. This should be made more exposed.

The documentation could be better because it was not that comprehensively documented. When we started working with GitGuardian Platform, it was difficult to find some specific use cases, and we were not aware of that. It might have improved now, but at that time, it was not something we would recommend.

I have been using the GitGuardian Platform for almost a year now.

From 1 to 10, I rate the stability of the GitGuardian Platform a 10, as there are no downtimes.

I would rate the scalability as a 10, since we did not have any problems.

For technical support, I would give a solid 10. They have someone who speaks Spanish, which made it easier for us.

I am comparing it with Advanced Security from GitHub and Cycode.

Two of us were involved in the deployment process.

It took a week to deploy the GitGuardian Platform, just to standardize the process.

Two of us were involved in the deployment process.

Regarding return on investment, we have actually saved time and resources because before having GitGuardian Platform, we had two or three people working in every repository looking for secrets with open-source tools. It took a long time to find secrets or many patterns, and at the time, we had to configure our own patterns to find them. I cannot specify the exact return on investment, but I can surely say that we have saved significant time and resources, particularly in terms of people and automation.

I would compare the GitGuardian Platform to other solutions or vendors on the market as being easier to use, but it is not integrated with the CSM that we are using right now. That is the difference. It is easy to use, but it could be easier.

We are customers in our company's relationship with the vendor.

I work primarily with the CLI, focusing on pipelines and automations rather than the platform itself. The platform has remained almost the same within the year that we have been working with it.

We are not utilizing the automated playbooks yet.

I cannot determine if the pricing is cost-effective.

The vendor can contact me if they have any questions or comments about my review.

I have rated the GitGuardian Platform a 10 out of 10.

I use GitGuardian Platform to ensure that there are no secrets committed, such as hardcoded values, database credentials, API keys, or any secrets that could be exposed to external users of our application. To maintain security and data accuracy, confidential data should not be shared with other platforms. GitGuardian Platform checks our local code first, then it passes through our CI/CD pipeline as well. When we push code to GitHub, it scans and sends a report via Gmail, so we have to fix those security vulnerabilities.

The best features of GitGuardian Platform are that it detects everything being pushed through the repository and scans everything comprehensively. It checks the possibility of exposure, so if there are API keys or database passwords being used, it warns us to either remove, rotate, or replace them, ensuring they should not be present in a GitGuardian Platform scan.

Our company has seen many benefits from using GitGuardian Platform, especially since there have been numerous cyber attacks and security threats in the last two to three years. Our company has remained very safe in this regard because we need to secure our data effectively, being in the insurance reinsurance sector. GitGuardian Platform ensures our data is protected by regularly scanning the repositories and sending us reports on how to fix vulnerabilities, keeping us safe from cyber attacks.

GitGuardian Platform could improve by providing a more user-friendly UI with tips or solutions. With AI advancements, they could offer AI-specific solutions in scanning reports, suggesting fixes for GitGuardian Platform incidents, and even permit automated fixes, which would significantly reduce the developer's workload.

I have been using GitGuardian Platform for the last one year.

Stability and availability of GitGuardian Platform are commendable; it is stable and available.

It is stable because when I push changes, it scans immediately, confirming fixes. There is no downtime during scanning, maintaining stability and availability.

I find support good since we have not needed much help from them. The guidelines provided are sufficient for guiding us on what to fix.

There are many tools in our organization for similar purposes, but GitGuardian Platform is specifically for exposing secrets. We also use Snyk for vulnerability scanning, among others, though I cannot recall all of them.

The decision was made by my organization, not me, so I am not sure about the parameters they considered before choosing GitGuardian Platform.

GitGuardian Platform prioritizes incidents in our workflow through automated validity checks. There are high risk, low risk, and medium risk incidents raised, and the infosec team prioritizes them and approaches us, the developers who pushed those changes, to fix them accordingly.

GitGuardian Platform's public leakage detection influences our company's data security as a precaution. We are not sure if data might be exposed, but taking this precaution by scanning the repositories is crucial. A cyber attacker just needs one piece of data, so we ensure at least that one thing is secured. It is about cyber attack prevention, ensuring all our data remains safe.

It rates the effectiveness of severity in incident management based on the severity of the change. This allows us to address the most important ones first. It checks what has been pushed from the code, raising a high-level vulnerability if database-related passwords are involved and reports it urgently. For low-level issues like hardcoded values for APIs, it is reported accordingly based on priority.

I use GitGuardian Platform's automated playbooks for scanning. Productivity-wise, these playbooks help me know if I am going to push code with secrets. I am aware now, so I intentionally avoid that, ensuring I write good code. It increases my productivity by helping me fix issues proactively. If GitGuardian Platform were not here and vulnerabilities were discovered later, there could be severe consequences. Currently, that impact has been reduced, minimizing our efforts significantly through early precautions.

Our organization is currently innovating on the AI side, which includes creating a custom agent to fix vulnerabilities, similar to GitHub Copilot. This agent automates changes required based on GitGuardian Platform scanning, closing incidents directly. This support reduces our efforts and timelines.

Fixing vulnerabilities now takes approximately 60% less time. If fixing took ten days, I now do it in six. I am not sure about multi-vault integration because I am just a developer using it to fix my code changes. I am not sure if I am using GitGuardian Platform's Honey Tokens feature. I would rate this product an 8.5 overall.

GitGuardian Platform is a security tool preventing the exposure of secrets. It is particularly valuable as a tool because it doesn't just identify exposed security issues, but works as a platform that gives developers an intuitive and easy way of reacting to and fixing the issues.

GitGuardian Platform captures all the major secret types we care about. It tends to be a bit overzealous in some categories, but it covers all the ones that we want to track and keep an eye on. It has great coverage over those.

GitGuardian Platform has helped save significant time for the security team by eliminating the need to seek out development teams and work with them on exposed secrets, as much of this is now handled proactively. The built-in process for developers interacting with exposed secrets saves them time fixing security problems before returning to their tasks. We can also provide customized remediation guidelines to developers.

Automated validity checks are super critical for us. If something is confirmed as valid in the platform, we know there is some externally accessible value that's exposed somewhere. It's then the top priority for us to engage in. It also gives us a lot of confidence. When the development teams come back and say that they have fixed it, GitGuardian Platform confirms that.

We rely a lot on GitGuardian Platform's self-service functionality so that developers handle incidents without us having to take action. We don't rely on automated severity scoring for incident management. While the severity rating is decent, we focus more on the validity feature and detector categories than on GitGuardian's high-risk ratings. We have customized remediation guidelines by providing specific internal context for handling exposed secrets. We use GitGuardian's integrations with other tracking platforms, but we don't have everything funneled into Jira. We use our own prioritization to see which ones we want to funnel into Jira.

The platform has given us a clear picture of the historical landscape, showing what has been fixed versus what remains hidden in historical data. This clarity has been helpful in planning security measures around issues that don't get self-healed.

We have it scanning our GitHub environments, Atlassian suite (Jira tickets, Confluence), and Slack messages. That gives us a nice coverage across the business.

The validity and self-healing playbook features of GitGuardian Platform is one of the most useful features for us. It automatically reaches out to developers for any leaks, notifying them immediately via email. We have Slack notifications set up, allowing developers to respond, provide feedback about sensitive values, and self-close issues by attesting completion on the platform. A high number of our exposures are remediated by developers before security needs to step in, as the self-healing playbook process engages them automatically. This results in issues being resolved within minutes, saving significant effort from the security team in tracking down or communicating with developers.

The analytics in GitGuardian Platform have a significant opportunity to better reflect the value provided to security teams and demonstrate actual activity occurring. While the self-healing capability and proactive developer actions are important features, the analytics do not provide information around this activity. They only track actions inside the platform when security team members assign themselves to issues and respond. The self-healing activity by developers isn't reflected in the analytics, requiring us to collect this data ourselves. This presents an opportunity for them to better showcase their developer-first remediation mindset.

We have been using GitGuardian Platform for approximately nine months.

It's a stable platform, we don't often have to think about it. The SaaS platform has experienced two significant moments of downtime or instability in the last six months, requiring notices and retrospectives. We also run a self-hosted cluster which has not experienced these issues, though we've faced some challenges upgrading Kubernetes that required support assistance to prevent internal downtime.

It is scalable. I would rate it a nine out of ten for scalability. 

My product security team administrates the platform, with a few other security people accessing it. Access to respond to incidents is deployed for every engineer. Team-based provisioning is not yet supported with SCIM, which makes team-based grouping a hassle, so we do not use it.

I would rate their technical support a nine out of ten.

Positive

We were using a home-grown solution. 

The initial setup of the self-hosted cluster was moderately complex. We faced some issues because of the environment we had. We had to fix some installation errors and bugs in their Helm configuration.

In terms of deployment model, we self-host a cluster out of necessity. We have an internal GitHub Enterprise server. We self-host GitGuardian Platform to connect to that environment. We also use their SaaS version for Slack and Atlassian integrations.

We implemented in-house.

The majority of our incidents for critical detectors and important secret types are remediated automatically or proactively by developers through GitGuardian's notification system, without security team involvement. It saves a lot of time for the security teams and the developers. It probably saves approximately 10 hours per week. Previously, we needed an extra 20% of our time focused on this subject area, which has now been saved because of this platform.

It's competitively priced compared to others. Overall, the secret detection sector is expensive, but we are happy with the value we get.

We evaluated other vendors on the market. The secret detection capabilities of most vendors are basically equivalent, capturing all major types of secrets. The management and administration of findings after scanning is what differentiates vendors. Many alternatives lack strong administration capabilities for security teams after finding detections. GitGuardian's dashboard, self-healing playbooks, and ways for the security team to monitor, track, and deduplicate detections make it easier to manage the program compared to competitors.

I would recommend GitGuardian Platform to other users due to the ease of management for the security team with the dashboard. It offers easy administration of results. The proactive self-service capabilities provided to developers remove the burden from the security team and enable faster remediation of exposed values.

My overall rating for GitGuardian Platform is an eight out of ten.

My main use case for GitGuardian Platform is monitoring the repositories for exposed secrets and credentials and reviewing security alerts. I also use it to remediate any findings that come up.

The majority of the time we are thinking about potential secret exposure across repositories and prioritizing the findings which need attention. GitGuardian Platform gives a good additional layer of security alongside our existing practices.

A specific example of a time when GitGuardian Platform helped me catch and fix an exposed secret is when developers hardcode API credentials while developing. There is always a chance that a developer makes a mistake and hardens an API credential in a repository. We are able to identify and remove the credentials, rotating them before they could be misused. This is a quick specific example we have encountered, and it is usual for anyone.

The best features GitGuardian Platform offers that stand out most for me are the secret key detections and real-time alerts. I also find the incident tracking and remediation workflow useful because it makes it easier to understand, identify, investigate, and address exposed credentials.

GitGuardian Platform has impacted my organization positively by allowing us to identify usually exposed credentials earlier, reducing the time spent on manually checking repositories where credentials have been exposed, and it also gives better visibility into the status of security findings and their remediation. GitGuardian Platform offers a more structured way, and we can quickly identify exposed secrets by this process, assign them to the right person, and track the remediation until it is resolved. It reduces the manual effort of coordinating and following up with the security findings.

One area of improvement for GitGuardian Platform would be reducing false positives and making some alerts easier to prioritize. A more streamlined interface for investigating and grouping related findings would also make the workflow faster.

Alert prioritization and better customization of alert notifications would help, especially for filtering low-priority findings. More detailed remediation guidance within the alerts would also make it easier for newer users to resolve issues quickly.

I have been using GitGuardian Platform for around one year.

GitGuardian Platform has been generally stable for day-to-day monitoring and alerting. I have not faced any major reliability issues during regular use, although occasional alert delays can happen.

GitGuardian Platform has good scalability from my experience. As the number of repositories and users increased, we have not had any major performance issues, and onboarding additional repositories has been relatively straightforward.

I have limited direct interaction with GitGuardian Platform's support, but the responses we received were helpful and reasonably quick. Most of the issues are dealt with through documentation and internal processes, so we did not go to support directly.

We have not used anything previously before GitGuardian Platform.

Regarding the return on investment, I do not have exact metrics, but in practice, it has reduced manual effort to check repositories and follow up on findings. The biggest improvement has been catching potential exposures earlier and shortening the remediation cycle.

Regarding my experience with pricing, setup cost, and licensing, the pricing from the feedback seems to be reasonable for an enterprise security platform, though the overall cost depends on the number of users and repositories.

Before choosing GitGuardian Platform, we evaluated secret management and secret scanning tools, but I was not directly involved with that final selection, so I do not have a complete list or detailed comparison about that.

My advice for others looking into using GitGuardian Platform is to clearly define your secret scanning and remediation workflow before implementing it. Also, make sure alerting and integrations are configured properly so the team can act on findings without creating too much noise.

Regarding GitGuardian Platform's AI capabilities, I think its governance and security are useful for improving detection and investigation. While governance and security controls are important for keeping the process controlled, from my experience, GitGuardian Platform provides a good foundation, though clearer visibility into AI decision-making and configuration would be helpful.

When it comes to the accuracy and reliability of output, from my experience, the AI-assisted detection is generally accurate and useful for identifying potential secrets and prioritizing findings. I would still validate important findings manually, especially when the context is ambiguous or there is a possibility of a false positive.

I would rate this review an eight out of ten.

I use GitGuardian Platform mainly to prevent and detect exposed credentials, API keys, database connection strings, cloud credentials, and SSH keys within our repository and within the CI/CD pipelines. It works as a safety net that automates everything to ensure the code is clean and can reach production properly and that there are no credential leaks.

When we have made a commit with some secret hardcoded in the code, it has automatically notified us by email saying that the Git commit cannot be done because it has exposed secrets.

We trust it and we see that it is really working. It detects if there is any code leakage, and it is very useful when you have public repositories.

The best features offered by GitGuardian Platform are historical scanning, since it incorporates all existing repositories and all legacy repositories. The ability to analyze histories is amazing. It brings to light exposed credentials in old commits, forgotten branches, and it is a pretty good, quite complete standard scanner. It has real-time detection and CI/CD integration. It intercepts secrets in the pipeline itself or through a pre-commit hook. This is useful because you do not even get to make the commit; instead, you detect the leak beforehand. It directly notifies the specific developer so they can fix the problem, which is great.

Regarding CI/CD integration and real-time detection, it has impacted the number of incidents or security leaks we have in the company. In the company we have ISO 27000 and the National Security Scheme, and one of the KPIs we have specifically is security leaks or security breaches. Since we have GitGuardian Platform, secrets in code are better monitored.

The reduction of security leaks since we implemented GitGuardian Platform has been drastic and we have brought the indicator down to zero percent of secrets revealed within the code.

GitGuardian Platform has the occasional false positive in testing. Sometimes it detects simulated or dummy keys that are put into unit tests. The management of custom patterns could be a bit more streamlined or a bit more automated, as it detects certain formats with internal tokens.

I have been using this tool for two or three years.

GitGuardian Platform is super stable, a ten out of ten. It works without any latency, everything working in real time, without penalizing compilation time.

It scales without problems across multiple repositories and developer accounts without loss of performance at peak working hours.

I have not needed to use GitGuardian Platform support.

We did not use any similar solution previously.

For costs, we are on the free version for up to twenty-five developers, so we are totally covered. As for the implementation, it is super simple. You open GitHub, open the GitGuardian Platform connector, configure the repositories you want it to monitor, and it is running. The learning curve and monitoring are almost zero. We use GitGuardian Platform's SaaS. What we did was configure it with the GitHub connector, which took just a few clicks, and you just set it to work and notifications and responses start arriving about all your repositories that you share.

We did not evaluate other options initially. We discovered GitGuardian Platform and since the implementation was very fast, the license we use for the number of developers we have in the company is the free one, and everything worked the first time and everything is working perfectly, we have not evaluated other options.

I have seen a return on investment by the reduction of security incidents. We have reduced security incidents related to secret leaks.

For costs, we are on the free version for up to twenty-five developers, so we are totally covered.

We did not evaluate other options initially. We discovered GitGuardian Platform and since the implementation was very fast, the license we use for the number of developers we have in the company is the free one, and everything worked the first time and everything is working perfectly, we have not evaluated other options.

GitGuardian Platform is a ten. I give GitGuardian Platform a ten because it is super stable, it has no service interruptions, the webhooks and real-time analysis respond with total consistency, without penalizing pull request compilation times. It is very scalable; it has grown as our team has grown. It protects us and we are quite happy with it.

They should try it without any doubt. It is a marvel that fulfills everything it promises. If you are applying shift-left security policies within your company and you want to put a hard stop to credential leaks within your microservices architecture or your cloud infrastructure, GitGuardian Platform is one of the most effective tools I have found on the market. It covers the gap between DevSecOps and development very well. As long as you dedicate some initial time to adjusting exceptions in test environments, it works wonderfully.

I give GitGuardian Platform an overall rating of ten out of ten.

GitGuardian Platform provides security through secret detection and broader code security. The main benefit is ensuring that secrets are properly managed across our organization.

Honeycomb has many repositories, multiple agents, multiple backends, numerous React frontends, AWS Lambda integrations, automations, third-party APIs, and multiple developers. To manage all of this, we maintain hundreds of secrets to ensure that developers do not commit environment files and that everything is properly secured. GitGuardian Platform scans every commit, branch, pull request, and the entire repository history, which informs us about security gaps and code issues. Because it continuously monitors our system rather than performing just one scan, when a developer pushes code, we receive alerts that are generated immediately. This continuous monitoring capability has made GitGuardian Platform our main solution.

GitGuardian Platform offers numerous integrations, including GitHub, GitLab, AWS, email, Jira, and Slack. The continuous monitoring system that watches for pushes as soon as developers commit code is also a valuable feature.

Integration with Slack and Jira allows developers to be notified immediately when a secret is detected, so they can revoke or rotate credentials before they are abused. Jira integration helps us track issues effectively through resolution by automatically creating tickets and assigning ownership.

GitGuardian Platform has provided accurate and reliable output for detecting common secrets and credentials. Most alerts provide sufficient context to investigate and remediate issues properly. From a security perspective, no exposed credentials are shared between branches. When credentials are shared, they are detected easily, and developer awareness around secret management has improved.

The automated checks encourage developers to remove or rotate exposed credentials before code is merged. GitGuardian Platform is working well for our organization, and I currently see no needs for improvements. However, deeper integrations with AI development workflows and services would be useful because security is a main concern with the use of AI agents.

I rate GitGuardian Platform a nine out of ten because there is a slight learning curve in integration, and I would have preferred integration with AI-native development workflows. With the increase of AI-focused workflows and incident prioritizations, AI agents need a security system that can flag security leaks. Apart from AI workflow considerations, the platform performs well.

I have been using GitGuardian Platform for approximately two years.

GitGuardian Platform is stable.

GitGuardian Platform demonstrates good scalability and is well suited for organizations managing multiple repositories and multiple developers with centralized monitoring.

We have not used any solution before GitGuardian Platform.

I was not directly involved in evaluating pricing, but the setup from a technical perspective was straightforward.

I do not have quantified ROI figures because our team has not tracked them separately. For us, the return is more about reducing security risks and avoiding costs than achieving a direct, measurable financial benefit.

For others considering GitGuardian Platform, I recommend starting by connecting your most critical repositories and running a historical scan to identify any existing exposures. I also recommend integrating it with your pull request workflow and notification tools such as Slack or Jira, so any detected issues are addressed early. Establishing a clear process is crucial, and GitGuardian Platform delivers the most value when it is incorporated into the development workflow rather than used only for occasional scans. I rate this product a nine out of ten.

We use GitHub as our source code platform. When we shifted from on-premise version control systems, we identified a requirement for capable tooling that could both find secrets that were committed in the past, and prevent and alert on secrets that were being accidentally committed.

GitGuardian gives us a better understanding of what's going on in our source code. Persistent use of the platform has allowed us to highlight areas where we need to improve; eg. providing training so that people know what information should and should not be in GitHub. 

We've managed to use this data to improve practices related to where teams store their secrets, and have also been able to use it to understand where we might be lacking tooling. 

When a developer commits a secret or there's a particular pattern in a repository, we often ask them about why they did this. They may turn around and say that there's no better option at the moment because we don't have a platform to suit x, y, or z. We can use that information to then drive decisions around whether or not we need to look into improved tooling or patterns that our engineering teams can use to avoid storing secrets in their source code.

Automated validity checks are very helpful; we use them to prioritise incidents, as they give us a quick understanding as to which secrets are still valid. They also help us to confirm that token invalidation - which sometimes has to be done by another team or a third party - has worked as expected.

We also utilize some of the automated playbooks, specifically those around automatic incident closure, allowing us to spend less time making sure that the incidents closed by changes to code are getting closed out.

Instantaneous notifications connected to our Slack platform allow us to deal quickly with incidents if and when they occur.

One of the best features of the solution, though, is the ability to use pre-push hooks. Preventing our developers from committing secrets into their source code before they hit the remote GitHub servers is ideal; it can be quite challenging and time consuming to remediate and rotate secrets once pushed to the remote.

The reporting feature has improved quite a bit since we first used it around five years ago, with filters that allow us to set up quick groups of or collections of filters and statuses to determine which secret detections are still unassigned and which are new. It allows us to easily ship those off to the developers involved in those incidents to get them remediated.

We'd love to see notification updates in Slack, as the system does not provide feedback on updates to incidents, which can be problematic when developers resolve issues. 

ie. if a developer commits code that triggers an incident, the alert comes into Slack, but by the time someone looks at it through the Slack alerting channel, the developer might have gone and already fixed or closed the issue. There's no feedback loop back into the notification channel to show that it's been addressed. 

Another thing that would be good to see is some more metrics on the usage of the GitGuardian pre-push hooks. It would be helpful to see which GitHub users have or do not have the pre-push hook capability turned on. That would allow us to chase people and say that we noticed that you're making commits, but you're not using GitGuardian, and encourage them to install ggshield before an accident happens.

My experience with the solution started in November 2020, which is approximately four or five years.

It's generally quite stable.

There has been a little bit of downtime of late, and it has been reasonably impactful when it's not been scanning. We set up our repositories in GitHub with GitGuardian as a required check. 

We had an incident for about four hours  last week and another one about a month before that. Prior to that, it's been really stable. 

It handles all the repositories and commit activity we have.

I would rate their technical support an eight out of ten.

Positive

No

We didn't have to do much. They manage all of the backend for us. All we have to do is integrate it into our GitHub organizations, and doing that is straightforward.

The solution does not require any maintenance.

In-house.

It's challenging to quantify, but it has saved us from a bit of panic because we know the state of our source code. It's hard to determine what savings might come from having the tooling or not.

It's fairly priced, as it performs a lot of analysis and is a valuable tool.

We have tested it against other solutions, such as TruffleHog, the open-source solution, and found the GitGuardian Platform to be about significantly better in terms of detection capabilities. TruffleHog focuses on secrets that it can validate, but in an Enterprise world with lots of internal tools, APIs and platforms it can miss a lot of secrets.

The new multi-vault feature looks useful; we are planning to connect it up to AWS Secrets Manager and HashiCorp Vault. 

I mainly use GitGuardian Platform to monitor source code and repositories for exposed secrets and credentials. I identify leaked API keys or tokens and help prioritize and remediate those findings before they can be misused.

Recently, I used GitGuardian Platform to scan a repository, and it flagged an exposed API credential in the code. I reviewed the finding, verified where the credential was being used, removed it from the repository, rotated the affected credentials, and updated the code to use a secure secret management approach instead.

The best features for me are automated secret detection, repository monitoring, and clear alerts for exposed credentials. I also find the ability to prioritize findings and track remediation useful because it makes it easier to quickly identify high-risk secrets and ensure they are properly addressed.

The feature I rely on most day-to-day is automated secret detection and repository monitoring. It continuously helps identify exposed API keys, tokens, passwords, and other credentials across repositories, so I do not have to manually review every change for potential leaks. It is especially important in my workflow because I work with security testing and code review, and catching a credential early allows me to investigate and remediate it before it becomes a larger security issue.

GitGuardian Platform has improved our security posture by giving us better visibility into exposed secrets across repositories. It has also made my daily workflow more efficient because I can quickly identify, investigate, and remediate leaked credentials instead of relying entirely on manual code reviews. Overall, it has helped make secret detection a more consistent part of our deployment and security process.

One area that could be improved is reducing false positives and making it easier to quickly understand the context and severity of a detected secret. More detailed remediation guidance and additional customization for alerts and scanning rules would also make GitGuardian Platform even more useful for security teams managing a larger number of repositories.

I have been using GitGuardian Platform for the last nine months.

GitGuardian Platform is very stable.

GitGuardian Platform has been scalable for our use case. It works well with the number of repositories and code changes growing while continuing to provide visibility into potential secret exposures. This makes it suitable for teams that need consistent secret detection across a growing deployment environment.

Customer support is good.

My experience with the pricing and licensing was generally positive. The setup was straightforward, and I found the licensing model relatively easy to understand. The overall cost felt reasonable for the visibility and security value provided, although pricing can vary depending on the organization's requirement and scale.

I have seen a positive return on investment, mainly through time saved in identifying and investigating exposed credentials. GitGuardian Platform reduces the amount of manual effort required for secret detection and helps the security team respond to findings faster. I do not have a specific dollar amount or percentage to share, but the improved efficiency and earlier detection provide clear value in our security workflow.

I would recommend evaluating GitGuardian Platform if secret detection and credential exposure are important concerns for your organization. It provides useful visibility into repositories, helps identify exposed credentials early, and makes investigation and remediation more efficient. I would suggest starting with the areas most relevant to your deployment workflow and then expanding coverage as needed. I gave this review a rating of 10.

Our primary use case for GitGuardian Platform is preventing credentials and other sensitive secrets from being accidentally committed to source code or exposed through our development and CI/CD workflows. We experienced one or two incidents where our secrets were leaked through Git when developers accidentally committed them or they were exposed through the pipeline. This is crucial from an infrastructure perspective because our application interacts with many cloud services. For example, development and deployment environments can contain AWS access keys, API keys, database credentials, and JWT tokens. The problem is not always intentional credential exposure, as a developer can accidentally include credentials in a .env file, Terraform variable, Docker file, or CI/CD configuration and commit it to Git.

GitGuardian Platform is designed to detect hardcoded secrets in both repositories and CI/CD workflows, including historical repositories and new contributions. It supports integrations with GitHub, GitLab, Bitbucket, and Azure DevOps, all of which we use in our organization. Our precise use case is to detect secrets before they become a production security issue.

GitGuardian Platform fits into our workflow in many steps. The first step is repository secret scanning, the second is CI/CD pipeline production, the third is pull request scanning, and the fourth is historical scanning.

Since adopting GitGuardian Platform, the most significant improvement in our organization is moving secret security earlier in the development process. Previously, the workflow involved developers committing secrets, which remained in repositories, leading to manual discoveries by the security team, credential rotations, and further investigations. This process was burdensome and time-consuming. Now, we have automated detection where developers commit secrets, the scanner detects them, the security team receives findings, and the secrets are either removed or rotated, significantly shortening the time between exposure and detection. This reduces our reliance on developers to remember every possible security rule.

I recall scanning twenty repositories for any secrets manually when our first AWS account was hacked, which took me around four days. However, GitGuardian Platform saves all those four days of my manual work by automating this process.

In my experience, the best features of GitGuardian Platform include real-time secret detection, which is invaluable for catching credentials close to when they are introduced rather than finding them weeks later. The second feature is historical repository scanning. Additionally, it has CI/CD integration, can integrate with multiple Git platforms, offers custom detectors, provides context-aware detection, and allows for severity and prioritization of issues.

The first three features have saved us considerably, particularly the real-time secret detection, while we initially also depended on historical repository scanning. As a DevOps professional, CI/CD integration is critically important to me.

I would improve GitGuardian Platform by reducing false positives and streamlining remediation. I also desire stronger integration around issue management workflows. For instance, once a critical secret is detected, the ideal workflow should involve detection, ticket creation, owner assignment, credential rotation, verification, and closure. The more automated this process becomes, the fewer manual security work is required.

I have been using GitGuardian Platform for around one year.

My advice for others considering GitGuardian Platform is that for DevOps and cloud infrastructure teams, integrating secret detection into normal development and CI/CD workflows makes much more sense than relying entirely on manual security reviews. This tool is incredibly useful. I would rate this product a ten out of ten.