Sold by
GitGuardian: The credential layer security platform (non-US companies)
GitGuardian helps companies close credential-based breach paths. It finds secrets wherever they live, prioritizes remediation based on rich context, and prevents new exposure across code, systems, and AI.
Reviews (332)
Meeti D.
Fast, Reliable Secret Detection That Fits Seamlessly into Our GitHub Workflow
Reviewed on Oct 18, 2026
Review provided by G2
What do you like best about the product?
The aspect of GitGuardian that I appreciate the most is its ability to spot exposed API keys, passwords, and other secrets before they evolve into security risks. Alerts are generated fast and come with valuable information concerning the location of the problem, making it easier to handle. I like the fact that it supports integration with GitHub and works within the framework of the usual development process without adding any unnecessary steps. Setup is relatively simple, while the automated scanning is particularly helpful when dealing with several projects at once.
What do you dislike about the product?
One area that could be improved is the dashboard, as some parts can feel confusing, especially for users who are trying the tool for the first time. False positives can also be frustrating, since you often have to manually verify whether the flagged value is actually sensitive. In addition, setting up and managing alerts could be more user-friendly, ideally with smarter filtering to reduce unnecessary distractions. Finally, the cost may become a concern for smaller groups that need access to the more advanced functions.
What problems is the product solving and how is that benefiting you?
GitGuardian resolves one of the most frequent issues with the accidental exposure of API keys, access tokens, passwords, and other types of secrets in the Git repositories. This may occur in the course of a normal development process, especially when dealing with environment variables, test credentials, and multiple integrations. With its ability to scan for any possible secrets and alert about their presence, it allows developers to detect vulnerabilities before releasing their code. The integration functionality makes it easier to use secret detection in the current development process.
Disha L.
Fast, Detailed Secret Detection That Fits Seamlessly into GitHub Workflows
Reviewed on Oct 18, 2026
Review provided by G2
What do you like best about the product?
What I like most about GitGuardian is that it helps catch exposed API keys, passwords, and other secrets before they turn into bigger security issues. The alerts come quickly and include helpful details about where the problem was found, which makes it much easier to track down and fix. I also appreciate that it integrates with GitHub and fits into a normal development workflow without creating a lot of extra overhead. Setup is fairly straightforward, and the automated detection is especially valuable when you’re working across multiple projects. Overall, it adds an extra layer of security without making day-to-day coding feel unnecessarily complicated.
What do you dislike about the product?
One area that could be improved is the dashboard. Some sections and settings take a bit of time to understand, especially for someone using the tool for the first time. False positives can also be frustrating, since you have to manually verify whether a detected value is actually sensitive. The initial configuration and alert management could be more intuitive as well, with smarter filtering to cut down on unnecessary notifications. Pricing may also become a concern for smaller teams that need advanced features. Overall, better onboarding, clearer navigation, and more intelligent alert prioritisation would make the experience even better.
What problems is the product solving and how is that benefiting you?
GitGuardian helps address a common issue in software development: accidentally exposing API keys, access tokens, passwords, and other sensitive information in Git repositories. These slip-ups can happen during everyday work, especially when dealing with environment variables, temporary testing credentials, or multiple integrations. By automatically scanning repositories for potential secrets and sending alerts when something suspicious is found, it enables developers to catch problems earlier rather than only noticing them after code has already been shared. Its integrations also make it easier to add secret detection into an existing development workflow. Overall, this can reduce the need for manual checks, speed up remediation, and lower the risk of security incidents, making it a practical addition to a development team’s security process.
reviewer777
Continuous secret scanning has protected our code history and strengthened secure development habits
Reviewed on Oct 16, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case for GitGuardian Platform is for secret detection in the code base, whether in the actual files or in the history of the GitHub code, helping me determine if there are, or were at any point, hard-coded secrets like API keys, passwords, or certificate key stores, and whether they are valid or false positives that require immediate remediation or remediation later on.
There was a specific time when GitGuardian Platform helped me catch something important, as it detected a couple of secrets that were still used in a project that had been migrated. We discovered in the history that while the current files contained no hard-coded secrets—everything had transitioned to using Secrets Manager—GitGuardian Platform identified two valid secrets in the GitHub history that needed to be deleted, although they were not critical or dangerous. To be on the safe side, we changed those secrets after ensuring they were properly removed from the history.
I have nothing else to add about my main use case or how I use GitGuardian Platform day-to-day. It is nice how it automatically scans whenever there is a commit in the GitHub repository, and even when a commit is deleted, the ID of the commit remains visible but grayed out, as it doesn't exist anymore. I would mention the validity check for public API keys is very useful while monitoring the security score. One limitation I've found is that as the tool progresses and updates, it may detect older secrets that have already been resolved, so it would be helpful to get notified when that occurs. Another significant limitation we've encountered is when the same secret is present in multiple repositories managed by different teams; we cannot close the incident unless both teams communicate and agree, because closing is applicable to all repositories, which is challenging when teams don't know each other.
How has it helped my organization?
GitGuardian Platform has positively impacted my organization by making the team extra careful about committing hard-coded passwords, even if they are just for testing purposes and deemed invalid. Additionally, my team has started integrating GitGuardian Platform on their local VS Code to scan before pushing code. It has also encouraged the habit of rotating old secrets that were at one point flagged in the tool.
I haven't noticed a reduction in security incidents, as we don't have many because we prioritize security in our development cycle. However, I can say that GitGuardian Platform helped us clean up our GitHub repositories of any type of secrets, even the useless ones, ensuring that if someone were to gain access, they wouldn't know what our API key or password looks like. It has especially helped us eliminate valid secrets from our repository histories, and we currently have zero valid secrets left.
What is most valuable?
The best features GitGuardian Platform offers include secret detection regardless of the commit history, which means it can detect both current and older files. Its ability to check the validity of API keys is crucial, and it allows tracing of actions regarding secrets—whether they are marked as false positives, invalid, or if remediation is necessary. Additionally, it facilitates the use of tools such as Slack or Teams for notifications.
I find myself relying the most on the instant scan of passwords offered by GitGuardian Platform, as it accurately checks for real secrets and does not mistake common words such as 'password' as a secret. This is advantageous compared to other tools that increase the rate of false positives significantly, which often occurs with keys that are merely for testing or are invalid.
What needs improvement?
Regarding improvements for GitGuardian Platform, the secret detection feature needs upgrading as it opens only one common issue for the same secret detected in multiple repositories. This poses a challenge, especially if two teams in different repositories, who don't know each other, are working with the same hard-coded secret. Team A cannot close the ticket independently because they are unaware of how Team B is using that secret. It would be much more effective to have a parent ticket for the secret that contains child tickets for each repository, allowing each team to manage their status for that secret as they see fit.
The reason I chose a nine or nine and a half is due to the pain points I've mentioned, particularly the challenges when validating secrets. Additionally, I prefer being notified whenever a new secret is detected in the GitHub history.
For how long have I used the solution?
I have been using GitGuardian Platform for almost two years.
What do I think about the stability of the solution?
GitGuardian Platform is very stable, with no downtime or issues in my experience.
What do I think about the scalability of the solution?
The scalability of GitGuardian Platform has met my organization's needs as we have grown or changed, and I did not notice any difference.
Which solution did I use previously and why did I switch?
Previously, we used the password detection feature in Checkmarx, but we switched because we found it unreliable. Checkmarx often flagged many false positives, sometimes misidentifying the word 'password' as a real password or mistaking names of secrets in Secrets Manager or Key Vault for secret values. Their lack of capability to detect hard-coded passwords in the GitHub history was another issue compared to what GitGuardian Platform offers.
What was our ROI?
I have seen a return on investment, particularly in securing the applications and ensuring there are no hard-coded secrets within the code base, which is a significant security positive.
What other advice do I have?
I haven't had the chance to thoroughly explore GitGuardian Platform's AI capabilities, so I'm not sure how I can answer that. Regarding my experience with the accuracy and reliability of GitGuardian Platform's AI capabilities, prior to their implementation, I found them to be helpful, especially in deciding the severity of a password when evaluating its risk from someone outside the application. My advice for others considering GitGuardian Platform is to move forward with it, as it's a great tool. I would rate GitGuardian Platform overall at nine, or nine and a half.
Hrithik G.
Great Project Feedback and Strong Secret Key Protection
Reviewed on Oct 15, 2026
Review provided by G2
What do you like best about the product?
It gives me feedback about my project, safeguard my project from leaking me env and secret keys, time to time notifications
What do you dislike about the product?
UI could have been better. It could be user friendly.
What problems is the product solving and how is that benefiting you?
So it saved my api keys from getting leaked in my last project. Before that, i mistakenly pushed my api keys with script, and that key was later revoked
reviewer2832933
Security monitoring has protected critical secrets and now needs stronger capabilities
Reviewed on Oct 15, 2026
Review provided by PeerSpot
What is our primary use case?
My main use case forGitGuardian Platform is secrets monitoring across public repositories and internal codebases. I use it to detect anything that matches keywords or signatures — particularly system secrets, tokens, and credentials that may have been accidentally exposed. When GitGuardian flags a potential exposure, I reach out to the responsible parties to ensure the secret is rotated and the risk is mitigated.
Security operations is the main use case for GitGuardian Platform, and we are using it in security operations as one of our large use cases.
How has it helped my organization?
GitGuardian Platform has had a significant positive impact on our organization. It has helped us uncover a number of exposed secrets, including critical tokens and credentials that were accidentally pushed to repositories. Without it, these exposures could have gone undetected and led to serious security incidents. Overall, it has meaningfully strengthened our secrets management posture.
What is most valuable?
The best features GitGuardian Platform offers include secret incidents, activity, push events, and commits.
The specific features that stand out to me as the best on GitGuardian Platform are the seamless integration capabilities and the incident detection capability that detects passwords and any high-entropy secrets, as well as the feature that allows us to segregate, flag, assign, and manage incidents. The incident tracking, seamless integration, and search functionality are all part of what makes it great.
What needs improvement?
GitGuardian Platform is already a mature and well-rounded product. The features, user interface, and integration capabilities all meet our needs effectively. At this point, I do not have any specific improvement requests — it does what it promises and does it well.
For how long have I used the solution?
I have been using GitGuardian Platform for four and a half years.
What do I think about the stability of the solution?
Yes, GitGuardian is stable. In four and a half years of usage we have not experienced significant downtime or reliability issues.
What do I think about the scalability of the solution?
GitGuardian scales well for our security operations needs. It handles monitoring across our repositories without performance issues.
How are customer service and support?
customer service and technical support have been satisfactory for our needs.
Which solution did I use previously and why did I switch?
No, I did not previously use a different solution for secrets monitoring. GitGuardian was our first dedicated platform for this use case.
How was the initial setup?
The initial setup was straightforward. Integration with our existing systems was seamless with minimal configuration effort.
What about the implementation team?
No
What was our ROI?
Yes. The platform flagged secrets and tokens that were accidentally pushed publicly
What's my experience with pricing, setup cost, and licensing?
I am not involved in pricing discussions
Which other solutions did I evaluate?
We did not evaluate other solutions extensively before choosing GitGuardian. It met our requirements for secrets monitoring and security operations out of the box.
What other advice do I have?
I would rate GitGuardian Platform a seven out of ten because I appreciate it; it is not the best tool, but it is above other tools.
Regarding GitGuardian Platform's AI capabilities, I think it is secure, and it could benefit from using AI systems for security purposes.
I find the accuracy and reliability of GitGuardian Platform's AI output to be on point. I would tell anyone researching GitGuardian Platform on PeerSpot that my overall rating for this product is seven out of ten.
Samrat j.
Instant Secret Detection with Developer-Friendly Integrations
Reviewed on Oct 15, 2026
Review provided by G2
What do you like best about the product?
GitGuardian excels at instantly catching hardcoded secrets, API keys, and credentials before they ever reach public or shared codebases. Its developer-friendly integrations make remediation effortless without slowing down fast-moving software development teams.
What do you dislike about the product?
When you first connect GitGuardian to a large project, it flags everything that looks like a key. Test credentials, mock data, example strings, and dummy keys in test files often get caught in.
What problems is the product solving and how is that benefiting you?
As an AI engineer, GitGuardian keeps me from accidentally leaking my API keys, huggingface tokens, and database credentials inside my code, prompt histories, or model config files. That saves me from expensive surprise cloud bills and massive security headaches without forcing me to constantly check every file I commit manually.
Swaraj J.
Simple, User-Friendly Interface That’s Easy to Understand
Reviewed on Oct 13, 2026
Review provided by G2
What do you like best about the product?
Simple interface easy to understand for users
What do you dislike about the product?
Personal point of view everything is seems fine
What problems is the product solving and how is that benefiting you?
It is an automatic security shield and continuously tracks the repo commit history in real time, helping me protect my API keys, which is a great benefit for me
Anonymous
Seamless Key Protection with Room for Optimization
Reviewed on Oct 10, 2026
Review provided by G2
What do you like best about the product?
I like GitGuardian's ability to automatically catch and block hidden API keys and passwords in code, which helps prevent accidental data breaches. I appreciate its feature of safely testing if a flagged password or key is actually live, as it eliminates false alarms by identifying active threats. The seamless integration with CI/CD platforms like GitHub Actions, as well as communication tools like Slack for instant alerts, is another highlight. What stands out is its easy setup; installing the GitHub App and connecting repositories is incredibly straightforward, requiring just two clicks.
What do you dislike about the product?
GitGuardian could offer more flexible pricing for mid-sized teams, which would be really helpful. Also, the high CPU usage during local pre-commit scans is a bit of a problem sometimes, as it slows down large codebases. It would be great if the pre-commit checks could be limited to only newly modified lines of code instead of scanning entire files, to optimize performance.
What problems is the product solving and how is that benefiting you?
I use GitGuardian to automatically catch and block hidden API keys and passwords, protecting against data breaches by finding and securing leaks instantly. Its live testing feature eliminates false alarms and integrates smoothly with tools like GitHub Actions, Slack, and Splunk for centralized security.
Keshav M.
Quick, Reliable Secret Detection with GitGuardian
Reviewed on Oct 10, 2026
Review provided by G2
What do you like best about the product?
I really like GitGuardian’s ability to quickly detect exposed secrets and credentials in code, which makes it easier to catch issues early.
What do you dislike about the product?
Need little more customisation and navigation that will be easier for the user.
What problems is the product solving and how is that benefiting you?
GitGuardian helps detect exposed secrets and credentials in code, reducing the risk of security incidents. It saves time by automatically identifyiny.
Yash L.
Proactive Error Alerts for Peace of Mind
Reviewed on Oct 10, 2026
Review provided by G2
What do you like best about the product?
Please send me an alert whenever any error occurs, or if something goes wrong.
What do you dislike about the product?
It doesn’t give me an alert when the API key is not being used.
What problems is the product solving and how is that benefiting you?
GitGuardian helps us detect exposed passwords and other sensitive information in our code. It strengthens our security, helps prevent data leaks, and keeps our projects safer overall.