GitGuardian

Overview

GitGuardian is a secrets-security platform for organizations that need to detect exposed credentials across software development workflows. It suits application security teams and threat-response teams, with broader governance and deployment options for larger enterprises. Its strongest case is coverage from developer coding through internal and public monitoring; the key trade-off is that paid-plan pricing is sales-based and scan capacity varies by tier.

Founded in 2017 and headquartered in Paris, GitGuardian also describes its scope as including non-human identity (NHI) governance and AI agent security.

For more tools in this category, see Secrets Scanning Software.

Key features

Repository and workflow scanning: GitGuardian scans repositories in real time and historically across GitHub, GitLab, Bitbucket, and Azure DevOps. CI/CD, pull-request, and pre-commit scanning, push protection, and custom detection rules extend coverage across the development process. That breadth is useful for teams seeking more than a one-time repository check.

Internal and public monitoring: Internal Secrets Monitoring searches code, CI/CD, and collaboration tools; Growth also covers containers and custom sources. Public Secrets Monitoring detects secrets exposed on public GitHub. Growth limits public monitoring, while Enterprise makes it unlimited, so teams with broad public exposure concerns should account for that tier boundary.

Developer CLI: The ggshield command-line tool scans for secrets during coding and supports pre-commit hooks. It gives developers a local workflow alongside centralized monitoring.

Remediation and administration: Growth includes remediation playbooks, AI risk scoring, and false-positive filtering, with notifications through Slack, Teams, email, Jira, and ServiceNow. SAML 2.0 SSO, SCIM, IP allowlisting, and privacy mode add administrative controls. These capabilities make the paid offering more than detection alone.

NHI governance and deployment: Enterprise adds vaults, identity mapping, and OWASP policies for NHI governance, plus self-hosting through GitGuardian Bridge, with Helm or KOTS deployment support. A dedicated support channel is included; Premium Care is an add-on. These additions are aimed at organizations with governance or deployment requirements beyond hosted secret scanning.

Pricing

GitGuardian uses a freemium model, offers a free plan, and provides a 30-day trial. Growth uses contact-sales pricing; Enterprise has custom pricing and requires contacting sales.

PlanPrice and termsWhat it includes and the trade-offStarterfree; billed AlwaysUp to 25 developers, unlimited real-time scanning, up to 500 historical scan detections, and 10K API calls/month. Its 1 GB repository scan capacity and historical-detection cap make it a practical entry point, but not an unlimited historical scanning tier.GrowthCustom pricing; billed Contact salesEverything in Starter, internal monitoring for code, CI/CD, containers, and custom sources, limited public monitoring, up to 10 teams, and US and EU data hosting regions. Its 12 GB scan capacity supports larger workloads, but public monitoring remains limited and team count is capped.EnterpriseCustom pricing; billed Custom; contact salesEverything in Growth, unlimited public monitoring, NHI governance, self-hosted deployment, unlimited teams, and 12-month audit log retention. Its 60 GB scan capacity and governance features suit larger programs, though the price requires a sales conversation.Starter is the clear fit for small teams that can work within its developer, historical detection, API, and repository capacity limits. Growth is for organizations that need internal coverage beyond repositories and more team administration. Enterprise is the choice when unlimited public monitoring, self-hosting, or NHI governance is required.

Platforms

GitGuardian supports API, Linux, macOS, self-hosted, web, and Windows platforms. Self-hosted deployment is an Enterprise option. Its listed version-control integrations are GitHub, GitLab, Bitbucket, and Azure DevOps.

Who it's for

Application Security teams are the typical users of Internal Secrets Monitoring, while Threat Response teams commonly use Public Secrets Monitoring. Development organizations that want scanning integrated into coding and repository workflows will benefit from ggshield, pre-commit checks, and pull-request scanning. Organizations that need NHI governance, self-hosting, or unlimited teams should look at Enterprise; smaller teams may find Starter sufficient if its caps match their workload.

Pros and cons

Pros: Real-time and historical repository scanning, plus CI/CD, pull-request, pre-commit, and push-protection capabilities, can cover several points where secrets may enter or surface in a development workflow.

Pros: The free Starter plan includes unlimited real-time scanning for up to 25 developers, making it a meaningful entry tier rather than a time-limited evaluation alone.

Pros: Growth and Enterprise add remediation and governance capabilities, and Enterprise offers self-hosted deployment for organizations that need it.

Cons: Starter limits historical detections to 500 and repository scan capacity to 1 GB, so teams with larger historical or repository workloads may need a paid tier.

Cons: Growth includes only limited public monitoring, while unlimited public monitoring is reserved for Enterprise.

Cons: Growth and Enterprise have sales-based pricing, so their cost cannot be compared directly from a published tier price.

Alternatives

ggshield is worth considering when the priority is an open-source command-line scanner: the CLI is open source, though the secrets detection library behind GitGuardian’s public API is closed source. Vooda AI may suit readers specifically seeking a self-hosted option with a free plan. Semgrep Code is a broader code and supply-chain option; its free edition covers up to 10 repositories and 10 contributors. Amazon Deequ is a free open-source library for teams that need data quality checks and can use Apache Spark, rather than a direct secrets-monitoring substitute.

Endor Labs is another option. Kingfisher is another free option. TruffleHog may appeal to teams seeking an open-source plan with many secret detectors and integrations including GitHub Actions and pre-commit hooks. Arnica Secrets Security is an alternative for readers looking for a free plan that combines secrets scanning with SAST, SCA, IaC, licensing, and reputation scans.

Verdict

GitGuardian is best for security teams that want secret detection to span developer workflows, internal sources, and public GitHub, with room to add remediation and enterprise governance. The breadth of scanning and the useful free Starter tier are its main draws. Look elsewhere if you need predictable published pricing, or if Starter’s scan and historical-detection caps cannot accommodate your workload without moving to a sales-priced plan.