GitGuardian Platform

Our primary use case for GitGuardian Platform is preventing credentials and other sensitive secrets from being accidentally committed to source code or exposed through our development and CI/CD workflows. We experienced one or two incidents where our secrets were leaked through Git when developers accidentally committed them or they were exposed through the pipeline. This is crucial from an infrastructure perspective because our application interacts with many cloud services. For example, development and deployment environments can contain AWS access keys, API keys, database credentials, and JWT tokens. The problem is not always intentional credential exposure, as a developer can accidentally include credentials in a .env file, Terraform variable, Docker file, or CI/CD configuration and commit it to Git.

GitGuardian Platform is designed to detect hardcoded secrets in both repositories and CI/CD workflows, including historical repositories and new contributions. It supports integrations with GitHub, GitLab, Bitbucket, and Azure DevOps, all of which we use in our organization. Our precise use case is to detect secrets before they become a production security issue.

GitGuardian Platform fits into our workflow in many steps. The first step is repository secret scanning, the second is CI/CD pipeline production, the third is pull request scanning, and the fourth is historical scanning.

Since adopting GitGuardian Platform, the most significant improvement in our organization is moving secret security earlier in the development process. Previously, the workflow involved developers committing secrets, which remained in repositories, leading to manual discoveries by the security team, credential rotations, and further investigations. This process was burdensome and time-consuming. Now, we have automated detection where developers commit secrets, the scanner detects them, the security team receives findings, and the secrets are either removed or rotated, significantly shortening the time between exposure and detection. This reduces our reliance on developers to remember every possible security rule.

I recall scanning twenty repositories for any secrets manually when our first AWS account was hacked, which took me around four days. However, GitGuardian Platform saves all those four days of my manual work by automating this process.

In my experience, the best features of GitGuardian Platform include real-time secret detection, which is invaluable for catching credentials close to when they are introduced rather than finding them weeks later. The second feature is historical repository scanning. Additionally, it has CI/CD integration, can integrate with multiple Git platforms, offers custom detectors, provides context-aware detection, and allows for severity and prioritization of issues.

The first three features have saved us considerably, particularly the real-time secret detection, while we initially also depended on historical repository scanning. As a DevOps professional, CI/CD integration is critically important to me.

I would improve GitGuardian Platform by reducing false positives and streamlining remediation. I also desire stronger integration around issue management workflows. For instance, once a critical secret is detected, the ideal workflow should involve detection, ticket creation, owner assignment, credential rotation, verification, and closure. The more automated this process becomes, the fewer manual security work is required.

I have been using GitGuardian Platform for around one year.

My advice for others considering GitGuardian Platform is that for DevOps and cloud infrastructure teams, integrating secret detection into normal development and CI/CD workflows makes much more sense than relying entirely on manual security reviews. This tool is incredibly useful. I would rate this product a ten out of ten.

My main use case for GitGuardian Platform is monitoring the repositories for exposed secrets and credentials and reviewing security alerts. I also use it to remediate any findings that come up.

The majority of the time we are thinking about potential secret exposure across repositories and prioritizing the findings which need attention. GitGuardian Platform gives a good additional layer of security alongside our existing practices.

A specific example of a time when GitGuardian Platform helped me catch and fix an exposed secret is when developers hardcode API credentials while developing. There is always a chance that a developer makes a mistake and hardens an API credential in a repository. We are able to identify and remove the credentials, rotating them before they could be misused. This is a quick specific example we have encountered, and it is usual for anyone.

The best features GitGuardian Platform offers that stand out most for me are the secret key detections and real-time alerts. I also find the incident tracking and remediation workflow useful because it makes it easier to understand, identify, investigate, and address exposed credentials.

GitGuardian Platform has impacted my organization positively by allowing us to identify usually exposed credentials earlier, reducing the time spent on manually checking repositories where credentials have been exposed, and it also gives better visibility into the status of security findings and their remediation. GitGuardian Platform offers a more structured way, and we can quickly identify exposed secrets by this process, assign them to the right person, and track the remediation until it is resolved. It reduces the manual effort of coordinating and following up with the security findings.

One area of improvement for GitGuardian Platform would be reducing false positives and making some alerts easier to prioritize. A more streamlined interface for investigating and grouping related findings would also make the workflow faster.

Alert prioritization and better customization of alert notifications would help, especially for filtering low-priority findings. More detailed remediation guidance within the alerts would also make it easier for newer users to resolve issues quickly.

I have been using GitGuardian Platform for around one year.

GitGuardian Platform has been generally stable for day-to-day monitoring and alerting. I have not faced any major reliability issues during regular use, although occasional alert delays can happen.

GitGuardian Platform has good scalability from my experience. As the number of repositories and users increased, we have not had any major performance issues, and onboarding additional repositories has been relatively straightforward.

I have limited direct interaction with GitGuardian Platform's support, but the responses we received were helpful and reasonably quick. Most of the issues are dealt with through documentation and internal processes, so we did not go to support directly.

We have not used anything previously before GitGuardian Platform.

Regarding the return on investment, I do not have exact metrics, but in practice, it has reduced manual effort to check repositories and follow up on findings. The biggest improvement has been catching potential exposures earlier and shortening the remediation cycle.

Regarding my experience with pricing, setup cost, and licensing, the pricing from the feedback seems to be reasonable for an enterprise security platform, though the overall cost depends on the number of users and repositories.

Before choosing GitGuardian Platform, we evaluated secret management and secret scanning tools, but I was not directly involved with that final selection, so I do not have a complete list or detailed comparison about that.

My advice for others looking into using GitGuardian Platform is to clearly define your secret scanning and remediation workflow before implementing it. Also, make sure alerting and integrations are configured properly so the team can act on findings without creating too much noise.

Regarding GitGuardian Platform's AI capabilities, I think its governance and security are useful for improving detection and investigation. While governance and security controls are important for keeping the process controlled, from my experience, GitGuardian Platform provides a good foundation, though clearer visibility into AI decision-making and configuration would be helpful.

When it comes to the accuracy and reliability of output, from my experience, the AI-assisted detection is generally accurate and useful for identifying potential secrets and prioritizing findings. I would still validate important findings manually, especially when the context is ambiguous or there is a possibility of a false positive.

I would rate this review an eight out of ten.