GitGuardian Platform

My main use case for GitGuardian Platform is to detect and prevent exposed secrets as well as credentials in our source code such as API keys, passwords, tokens, and private keys. It also helps us identify leaked secrets in Git repositories and continuous integration and continuous development pipelines and take action before they can be misused.

A specific example of how I have used GitGuardian Platform in my workflow is during a code review when a developer accidentally committed API credentials into the Git repository. GitGuardian detected the exposed secret and flagged it before the change could move forward through our deployment workflow. We were able to identify the affected repository, revoke and replace the credentials, and remove the secret from the code. It was useful because the issue was caught early rather than being discovered after a potential security incident. We have used GitGuardian Platform as an additional security check across all our repositories development.

Day-to-day, we use GitGuardian Platform as part of our deployment, development, and code review process to continuously check our repository for exposed secrets. It helps us catch API keys, tokens, passwords, and credentials early because when an alert appears, we review the findings to identify whether it is an actual secret, take necessary actions such as removing or rotating the credential, and it gives the development team an extra layer of security without adding manual effort to our workflow.

The best features GitGuardian Platform offers include continuous secret scanning, real-time alerts, clear identification of exposed credentials, and easy access to find the repository, which is useful because it helps us quickly understand where a secret was exposed and what needs to be addressed. The integration with Git workflows makes it easy to include security checks without significantly slowing down development, helping the team to identify and respond to leaked API keys, tokens, passwords, and other sensitive information.

GitGuardian Platform has positively impacted our organization by improving our overall security awareness and helping us identify exposed credentials early in the development life cycle. It reduces the need for manual checks and gives the team better visibility into potential secrets across all the repositories. When an issue is detected, developers can easily investigate and resolve it quickly before it becomes a larger security concern. It has also encouraged better practices around handling all the API keys, tokens, and sensitive credentials, adding an extra layer of security to our development CI/CD workflow without creating any significant issues for the team.

GitGuardian Platform could be improved by providing an explanation of the potential risks. Better visualization would help our team quickly focus on the most critical findings. It would also be useful to have a more customizable reporting dashboard for tracking team and repositories. The platform is easy to use, but these improvements could make investigation and remediation even faster.

The integrations are generally straightforward, but having more guided setup options and clear documentation for advanced integration would make the onboarding process even easier and faster. From a user experience perspective, more customization for the notification dashboard and alert workflow would be useful, especially for our last team. It would also be helpful to have more detailed remediation guidance within alerts. The platform is easy to work with, and the improvements in these areas would make it even more efficient for development as well as our security team.

I have been using GitGuardian Platform for approximately six to eight months.

GitGuardian Platform is stable.

GitGuardian Platform is very scalable.

Customer support for GitGuardian Platform is very good.

I have not previously used a different solution.

The integration process for our team with GitGuardian Platform has been fairly straightforward. The initial setup and connecting our Git repository do not take much time. The documentation made it easy to understand the required steps. Once everything integrated, GitGuardian Platform started providing visibility into potential secrets without requiring any major changes to our existing development workflow. The alerts are very easy to understand and help our team quickly identify what needs attention. The setup was smooth, and the platform fits well in our existing Git and CI/CD processes.

We are simply a customer of GitGuardian Platform, having no other business relationship with this vendor.

I see a good return on investment with GitGuardian Platform in terms of money as well as the time saved.

Pricing for GitGuardian Platform is moderate, not very cheap or very costly. I do not find anything discouraging regarding the pricing, setup cost, or licensing. Pricing is very moderate and friendly for all budgets, making it accessible for both large and small enterprises.

I did not evaluate other options before choosing GitGuardian Platform.

GitGuardian Platform provides strong visibility into exposed secrets and helps our development security team identify issues early. Its integration with our development workflow makes it practical to use without adding too much overhead.

We check the alerts or findings generated by GitGuardian Platform daily, using the alerts and fixing them on priority.

GitGuardian Platform helps improve collaboration between our security and development teams by giving both teams visibility into exposed secrets and the security findings. Developers can quickly understand and remediate issues, while security teams can monitor the situation, creating a more consistent and efficient security workflow across all teams.

Onboarding new users to GitGuardian Platform is very easy. The platform is intuitive, and new users can quickly understand the dashboards, alerts, and basic workflow with minimal training.

I always recommend GitGuardian Platform, as it is a very good solution for privacy, adding an extra layer of protection in our pipelines against the exposure of API keys. I would rate this product a nine out of ten.

Public Cloud

Amazon Web Services (AWS)

What do you like best about the product?

Installing ggshield as a pre-commit hook has been one of the simplest changes we’ve made with the biggest payoff. When a secret-like value shows up, the commit gets blocked before anything is pushed, and the CLI clearly shows what triggered the detection. We also run it in CI, and the same tooling can be used with pre-receive hooks, which makes it easier to keep checks consistent across local development and the repository. Historical Scanning is just as important, because removing a key from the current version of a file doesn’t remove it from older commits. We use the repository integrations and dashboard to trace the incident, pinpoint where the secret first appeared, and organize remediation. In larger setups, Remediation Playbooks and integrations with Slack, Jira, and ServiceNow help turn an alert into an actual process, instead of just another notification people acknowledge and forget. Honeytokens are a different kind of signal that I also find useful. We can create decoy AWS credentials through ggshield and place them in controlled locations; if someone uses them, there’s very little ambiguity about whether that access was expected. I wouldn’t replace normal monitoring with honeytokens, but they’re helpful when you want to detect real interaction with information that should never be touched.

What do you dislike about the product?

The first few weeks can be a bit noisy. Fixtures, test tokens, examples, and random strings sometimes look enough like real credentials to trigger detections. It’s tempting to throw together a giant ignore file and move on, but that usually defeats the purpose of the tool. Instead, we start by reviewing the finding, confirm it’s actually harmless, and then document the exception. The tuning takes some effort—especially in older repositories—but I’d rather deal with that friction than train the team to automatically dismiss every secret alert.

What problems is the product solving and how is that benefiting you?

We really saw the value during a hotfix, when a developer temporarily dropped a full database connection string into a .json file for local testing and then forgot to remove it before committing. ggshield blocked the commit immediately and flagged the exact value. Because the credential had already been shared through our local branch workflow, we rotated it right away, removed the value before anything reached the remote repository, and updated the project so configuration always comes from our secret manager. After that, we ran a historical scan and found an older API key buried in a commit from months earlier. Our first assumption was that it didn’t matter anymore because it was no longer on main, but the key was still valid, so we rotated that one too. Overall, GitGuardian prevented a new exposure from reaching the remote, helped us uncover an older one that would otherwise have stayed invisible, and pushed us to fix the workflow itself rather than treating the incident as a one-time cleanup.

What do you like best about the product?

I like GitGuardian because it's autonomous and easy to use. I don't have to log in to my GitGuardian account often since I receive notifications via email, which is comfortable for me. I appreciate that I can let it work in the background, and if something goes wrong, I get notified, with alerts even on my phone. The initial setup was quite straightforward as I connected directly with my GitHub account, making the process simple. Overall, it's comfortably good for my personal projects.

What do you dislike about the product?

Nothing, really

What problems is the product solving and how is that benefiting you?

I use GitGuardian to keep my secret keys or passwords safe when I push code. It's autonomous and easy to use, notifying me via email so I can address issues without logging into the account.

What do you like best about the product?

I like that GitGuardian catches things I might easily miss, especially exposed API keys or credentials. The alerts are pretty straightforward and make it clear what needs to be fixed. It feels like an extra safety net for the development process without getting in the way too much.

What do you dislike about the product?

The main thing I dislike is that some alerts can feel a bit noisy, especially when something is detected that isn’t really a serious risk. It sometimes takes extra time to figure out whether an alert actually needs action. I also feel the UI could make it easier to quickly understand the priority of an issue and what exactly I should do next. Overall it’s useful, but reducing unnecessary alerts and making the workflow a little simpler would make it better.

What problems is the product solving and how is that benefiting you?

GitGuardian helps us catch exposed secrets and credentials early, which saves a lot of manual checking and reduces the risk of security issues. Performance has been good overall, and it doesn’t slow down the development workflow too much. The integrations are also useful because we can connect it with the tools we already use. From a cost or ROI point of view, it is helpful because preventing one serious credential leak can save a lot of time and trouble later.The onboarding was fairly straightforward, although some areas could be explained better for new users. I also like the intelligence behind the alerts, but it could do a better job of reducing false positives and making it immediately clear which issues need the most attention.

What do you like best about the product?

I use GitGuardian as an automatic security 'checkpoint', which helps me prevent secrets from being accidentally shared. I like the fact that it integrates into the development flow without the need for new learning or additional steps. The tool detects secrets that should not have been committed, giving me time and peace of mind to regenerate secrets without worrying that someone might have accessed them. The initial setup was simple and easy, even though I know I can configure it better, I don't feel the need to do so at the moment.

What do you dislike about the product?

n/a

What problems is the product solving and how is that benefiting you?

GitGuardian acts as an automatic security checkpoint, detecting compromised secrets in real-time and providing peace of mind to regenerate them. It integrates easily into the development flow and helps monitor leaks, even with some false alarms.