Sold by: GitGuardian
Deployed on AWS
Vendor Insights
The end-to-end secrets security platform for enterprises. Scan and fix hardcoded secrets in source code, CI/CD pipelines, and productivity tools with GitGuardian code security platform.
4.8
Overview
GitGuardian is an end-to-end secrets security platform that empowers software-driven organizations to enhance their Non-Human Identity (NHI) security and comply with industry standards.
With attackers increasingly targeting NHIs, such as service accounts and applications, GitGuardian integrates Secrets Security and Secrets Observability. This dual approach enables the detection of compromised secrets across your dev environments while also managing legitimate secrets and their lifecycle.
The platform supports over 450+ types of secrets, offers public monitoring for leaked data, and deploys honeytokens for added defense
Trusted by over 600,000 developers, GitGuardian is the choice of leading organizations like Snowflake, ING, BASF, and Bouygues Telecom for robust secrets protection.
Highlights
- With Secrets Security, GitGuardian aims to eliminate leaks and sprawl, detecting compromised or misused secrets across both public and internal environments. This foundation of NHI security is strengthened by monitoring for incidents, policy violations, and illegitimate use of secrets.
- GitGuardian's Secrets Detection tackles internal secrets sprawl by identifying sensitive data in source code and productivity tools. The platform supports over 450 types of secrets, including API keys, private keys, and database credentials. With a robust policy engine, security teams can enforce rules across major Version Control Systems ( like GitHub, GitLab, BitBucket, and Azure DevOps, CI/CD tools such as Jenkins, Travis CI as well as tools like Slack, Jira, container registries, and more.
- To expand visibility beyond internal systems, GitGuardian Public Monitoring scans public GitHub repositories, detecting sensitive information in both organizational and developers' personal repos. This is crucial, as 80% of corporate secrets leaked on public GitHub stem from personal accounts.
Details
Sold by
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Skip the manual risk assessment. Get verified and regularly updated security info on this product with Vendor Insights.
Security credentials achieved
(2)
SOC2
GDPR
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
25 developers | Business Plan, per 25 contributing developers (annual contract) | $5,500.00 |
Dimensions summary
This listing offers one pricing dimension: the Business Plan, sold as an annual contract. You buy in blocks of 25 contributing developers. Pricing scales with your developer count, so you add units as your team grows. A developer counts as any active contributor who has made at least one commit in the last 90 days to a project you secure. To cover more than the base block, you add additional 25-developer units. Large organizations needing several hundred licenses can request a private offer instead.
Top-of-mind questions for buyers
A developer is any active contributor to a project you secure who made at least one commit in the last 90 days. Contributors to your open-source projects count only if they are actual employees. Repositories hosted under your organization stay free for scanning purposes.
You add units in blocks of 25 contributing developers. Cost scales with the number of units you buy under the annual contract. If your active contributor count crosses a block boundary, you purchase another 25-developer unit to cover the additional developers.
Developer count reflects active contributors who made at least one commit in the last 90 days to a project you secure. Because this can shift as teams change, you can contact the vendor to get a count based on your repository activity before sizing your units.
www.gitguardian.com
Helpful?
Vendor refund policy
Please contact sales@gitguardian.com to learn more about GitGuardian's refund policy.
Custom pricing options
Request a private offer to receive a custom quote.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
Explore our guides to use the GitGuardian Platform https://docs.gitguardian.com or submit a support request at
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By GitGuardian
By CyberArk
By Doppler
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Secrets Detection and Classification
Supports detection of over 450 types of secrets including API keys, private keys, and database credentials across source code and productivity tools
Multi-Platform Integration
Integrates with major Version Control Systems (GitHub, GitLab, BitBucket, Azure DevOps), CI/CD tools (Jenkins, Travis CI), and productivity platforms (Slack, Jira, container registries)
Public Repository Monitoring
Scans public GitHub repositories to detect sensitive information in both organizational and personal developer accounts
Policy Engine and Enforcement
Includes a robust policy engine that enables security teams to enforce rules and manage secrets lifecycle across integrated platforms
Honeytokens and Incident Detection
Deploys honeytokens for defense and monitors for incidents, policy violations, and illegitimate use of secrets in both public and internal environments
Centralized Secrets Management
Centrally secures, rotates, and manages secrets across multi-cloud and hybrid environments with a unified view across multiple AWS accounts and AWS Secrets Manager instances.
Multi-Platform Integration
Offers REST APIs and integrates with a wide range of DevOps tools, container platforms, vulnerability scanners, RPA, and automation tools for credential delivery.
Secrets Rotation and Lifecycle Management
Automatically rotates secrets in AWS Secrets Manager and across enterprise environments without requiring changes to developer workflows or applications.
Audit and Access Control
Provides centralized control and comprehensive auditing of how applications, DevOps tools, and automation platforms authenticate and access sensitive resources including databases and cloud environments.
Enterprise-Scale Architecture
Designed to support massive scalability with data sovereignty requirements for large global enterprises and eliminates vault sprawl across distributed environments.
Secrets Management and Centralization
Centralized platform for managing secrets across projects, teams, and environments to eliminate secrets sprawl
Automated Credential Rotation
Automatic rotation of credentials without downtime to safeguard against data breaches
Multi-Environment Integration
Automatic synchronization and deployment of secrets across environments and infrastructure through expanding suite of integrations
Access Control and Audit Logging
Scalable and flexible access controls with detailed activity logs for real-time access management and compliance
Developer-Centric Tools
VS Code extension for editing secrets alongside code with bidirectional synchronization and Doppler CLI for consuming secrets as environment variables
Validated by AWS Marketplace
FedRAMP
GDPR
HIPAA
ISO/IEC 27001
PCI DSS
SOC 2 Type 2
-
-
-
-
No security profile
No security profile
Standard contract
No
No
Customer reviews
Rahul K.
Fast, Clear Secret Detection with Easy GitHub Integration
Reviewed on Aug 10, 2026
Review provided by G2
What do you like best about the product?
What I like best about GitGuardian is how quickly it detects exposed secrets and sensitive credentials before they become a security issue. The alerts are clear, and it integrates well with GitHub, making it easy to catch mistakes during development. I also like the dashboard because it gives a good overview without being too complicated. It has definitely helped improve our security practices with very little setup.
What do you dislike about the product?
One thing I don't like is that some alerts can be a bit noisy at times, especially when you're working across multiple repositories. It takes a little time to fine-tune everything and decide which findings need immediate attention. The interface is good overall, but I think navigating historical incidents could be a bit more intuitive. Other than that, I haven't had any major issues with it.
What problems is the product solving and how is that benefiting you?
GitGuardian helps us detect accidentally exposed secrets like API keys, tokens, and passwords before they become a real security risk. Instead of manually checking repositories, we get alerts quickly, which saves time and reduces the chance of sensitive information being leaked. It has also helped improve our development workflow by making developers more aware of secure coding practices. Overall, it gives us more confidence that our repositories are staying secure.
Mir Shahzad Mubeen
Continuous secret monitoring has improved our code security and protected critical workflows
Reviewed on Aug 07, 2026
Review from a verified AWS customer
What is our primary use case?
GitGuardian Platform provides security through secret detection and broader code security. The main benefit is ensuring that secrets are properly managed across our organization.
Honeycomb has many repositories, multiple agents, multiple backends, numerous React frontends, AWS Lambda integrations, automations, third-party APIs, and multiple developers. To manage all of this, we maintain hundreds of secrets to ensure that developers do not commit environment files and that everything is properly secured. GitGuardian Platform scans every commit, branch, pull request, and the entire repository history, which informs us about security gaps and code issues. Because it continuously monitors our system rather than performing just one scan, when a developer pushes code, we receive alerts that are generated immediately. This continuous monitoring capability has made GitGuardian Platform our main solution.
What is most valuable?
GitGuardian Platform offers numerous integrations, including GitHub, GitLab, AWS, email, Jira, and Slack. The continuous monitoring system that watches for pushes as soon as developers commit code is also a valuable feature.
Integration with Slack and Jira allows developers to be notified immediately when a secret is detected, so they can revoke or rotate credentials before they are abused. Jira integration helps us track issues effectively through resolution by automatically creating tickets and assigning ownership.
GitGuardian Platform has provided accurate and reliable output for detecting common secrets and credentials. Most alerts provide sufficient context to investigate and remediate issues properly. From a security perspective, no exposed credentials are shared between branches. When credentials are shared, they are detected easily, and developer awareness around secret management has improved.
What needs improvement?
The automated checks encourage developers to remove or rotate exposed credentials before code is merged. GitGuardian Platform is working well for our organization, and I currently see no needs for improvements. However, deeper integrations with AI development workflows and services would be useful because security is a main concern with the use of AI agents.
I rate GitGuardian Platform a nine out of ten because there is a slight learning curve in integration, and I would have preferred integration with AI-native development workflows. With the increase of AI-focused workflows and incident prioritizations, AI agents need a security system that can flag security leaks. Apart from AI workflow considerations, the platform performs well.
For how long have I used the solution?
I have been using GitGuardian Platform for approximately two years.
What do I think about the stability of the solution?
GitGuardian Platform is stable.
What do I think about the scalability of the solution?
GitGuardian Platform demonstrates good scalability and is well suited for organizations managing multiple repositories and multiple developers with centralized monitoring.
Which solution did I use previously and why did I switch?
We have not used any solution before GitGuardian Platform.
How was the initial setup?
I was not directly involved in evaluating pricing, but the setup from a technical perspective was straightforward.
What was our ROI?
I do not have quantified ROI figures because our team has not tracked them separately. For us, the return is more about reducing security risks and avoiding costs than achieving a direct, measurable financial benefit.
What other advice do I have?
For others considering GitGuardian Platform, I recommend starting by connecting your most critical repositories and running a historical scan to identify any existing exposures. I also recommend integrating it with your pull request workflow and notification tools such as Slack or Jira, so any detected issues are addressed early. Establishing a clear process is crucial, and GitGuardian Platform delivers the most value when it is incorporated into the development workflow rather than used only for occasional scans. I rate this product a nine out of ten.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Shemanti P.
Proactive Secrets Detection That Fits Developers’ Workflow
Reviewed on Aug 03, 2026
Review provided by G2
What do you like best about the product?
What I like best about GitGuardian is its proactive approach to developer security. Instead of treating security as a final checkpoint, GitGuardian helps developers detect and remediate exposed secrets early in the development lifecycle. I also appreciate the company's strong focus on developer experience, practical security solutions, and commitment to open-source contributions, which makes security easier to adopt without slowing down development.
What do you dislike about the product?
One limitation is that GitGuardian is primarily focused on secrets detection and remediation. While it integrates well into broader security workflows, organizations still need additional tools for areas like vulnerability management, code quality, or broader application security. That's not necessarily a flaw, but it does mean GitGuardian is one part of a larger security stack rather than a complete security platform.
What problems is the product solving and how is that benefiting you?
GitGuardian solves the problem of exposed secrets—such as API keys, passwords, and tokens—that can accidentally be committed to source code or shared in repositories. These leaks are a common cause of security incidents and can be difficult to detect manually. By continuously scanning repositories and providing remediation guidance, GitGuardian helps teams identify and fix exposed secrets before they can be exploited. As a developer, I benefit from faster feedback, greater confidence when collaborating on code, and a smoother way to incorporate security into the development workflow without relying solely on manual reviews.
Rohit P.
Seamless Workflow Integration with Fast, Reliable Secret Detection
Reviewed on Jul 31, 2026
Review provided by G2
What do you like best about the product?
What I like most about GitGuardian is how seamlessly it fits into our development workflow while making secret detection simple and reliable. The interface is clean and easy to navigate, the integrations with our repositories were straightforward to set up, and scans run quickly without affecting our development process. The alerts provide enough context to understand the issue and fix it efficiently, which has helped us prevent accidental credential leaks before they become security incidents. The documentation and onboarding made it easy to get started, and overall the value it provides in reducing security risks and saving developer time makes it well worth the investment.
What do you dislike about the product?
One area that could be improved is reducing occasional false positives, as some alerts still require manual verification before taking action. I would also like to see more customization options for notification rules and reporting, especially for larger teams managing multiple repositories. While the platform is easy to use overall, some advanced settings can take a bit of time to discover, and more in-app guidance for those features would make the experience even better.
What problems is the product solving and how is that benefiting you?
GitGuardian helps solve the problem of accidentally exposing sensitive credentials like API keys, tokens, and passwords in source code. Instead of relying on manual code reviews to catch these issues, it automatically detects and alerts us early in the development process. This has reduced the risk of security incidents, saved time during reviews, and given our team greater confidence that we're protecting sensitive information before code is merged or deployed.
Antonio Tirado Peña
Automated secret detection has eliminated code leaks and enforces secure commits in pipelines
Reviewed on Jul 30, 2026
Review provided by PeerSpot
What is our primary use case?
I use GitGuardian Platform mainly to prevent and detect exposed credentials, API keys, database connection strings, cloud credentials, and SSH keys within our repository and within the CI/CD pipelines. It works as a safety net that automates everything to ensure the code is clean and can reach production properly and that there are no credential leaks.
When we have made a commit with some secret hardcoded in the code, it has automatically notified us by email saying that the Git commit cannot be done because it has exposed secrets.
We trust it and we see that it is really working. It detects if there is any code leakage, and it is very useful when you have public repositories.
What is most valuable?
The best features offered by GitGuardian Platform are historical scanning, since it incorporates all existing repositories and all legacy repositories. The ability to analyze histories is amazing. It brings to light exposed credentials in old commits, forgotten branches, and it is a pretty good, quite complete standard scanner. It has real-time detection and CI/CD integration. It intercepts secrets in the pipeline itself or through a pre-commit hook. This is useful because you do not even get to make the commit; instead, you detect the leak beforehand. It directly notifies the specific developer so they can fix the problem, which is great.
Regarding CI/CD integration and real-time detection, it has impacted the number of incidents or security leaks we have in the company. In the company we have ISO 27000 and the National Security Scheme, and one of the KPIs we have specifically is security leaks or security breaches. Since we have GitGuardian Platform, secrets in code are better monitored.
The reduction of security leaks since we implemented GitGuardian Platform has been drastic and we have brought the indicator down to zero percent of secrets revealed within the code.
What needs improvement?
GitGuardian Platform has the occasional false positive in testing. Sometimes it detects simulated or dummy keys that are put into unit tests. The management of custom patterns could be a bit more streamlined or a bit more automated, as it detects certain formats with internal tokens.
For how long have I used the solution?
I have been using this tool for two or three years.
What do I think about the stability of the solution?
GitGuardian Platform is super stable, a ten out of ten. It works without any latency, everything working in real time, without penalizing compilation time.
What do I think about the scalability of the solution?
It scales without problems across multiple repositories and developer accounts without loss of performance at peak working hours.
How are customer service and support?
I have not needed to use GitGuardian Platform support.
Which solution did I use previously and why did I switch?
We did not use any similar solution previously.
How was the initial setup?
For costs, we are on the free version for up to twenty-five developers, so we are totally covered. As for the implementation, it is super simple. You open GitHub, open the GitGuardian Platform connector, configure the repositories you want it to monitor, and it is running. The learning curve and monitoring are almost zero. We use GitGuardian Platform's SaaS. What we did was configure it with the GitHub connector, which took just a few clicks, and you just set it to work and notifications and responses start arriving about all your repositories that you share.
What about the implementation team?
We did not evaluate other options initially. We discovered GitGuardian Platform and since the implementation was very fast, the license we use for the number of developers we have in the company is the free one, and everything worked the first time and everything is working perfectly, we have not evaluated other options.
What was our ROI?
I have seen a return on investment by the reduction of security incidents. We have reduced security incidents related to secret leaks.
What's my experience with pricing, setup cost, and licensing?
For costs, we are on the free version for up to twenty-five developers, so we are totally covered.
Which other solutions did I evaluate?
We did not evaluate other options initially. We discovered GitGuardian Platform and since the implementation was very fast, the license we use for the number of developers we have in the company is the free one, and everything worked the first time and everything is working perfectly, we have not evaluated other options.
What other advice do I have?
GitGuardian Platform is a ten. I give GitGuardian Platform a ten because it is super stable, it has no service interruptions, the webhooks and real-time analysis respond with total consistency, without penalizing pull request compilation times. It is very scalable; it has grown as our team has grown. It protects us and we are quite happy with it.
They should try it without any doubt. It is a marvel that fulfills everything it promises. If you are applying shift-left security policies within your company and you want to put a hard stop to credential leaks within your microservices architecture or your cloud infrastructure, GitGuardian Platform is one of the most effective tools I have found on the market. It covers the gap between DevSecOps and development very well. As long as you dedicate some initial time to adjusting exceptions in test environments, it works wonderfully.
I give GitGuardian Platform an overall rating of ten out of ten.