GitGuardian Platform

My main use case for GitGuardian Platform is for security purposes when scanning our source repository, deployment, and all configurations where we can have credentials that cannot be shared with end users or any third party. This is why we are using GitGuardian Platform for security purposes to store all credentials securely.

In addition to the main use case, there are credentials we want to store for environment-related purposes. For production-related properties, we want to connect with Azure, Git, or some external APIs where we have secret API keys. We keep those in this secret management on Git so that we can secure our systems.

GitGuardian Platform's best features include automatically detecting issues in API keys, tokens, and passwords.

The automatic detection feature helps my team and workflow tremendously by saving a lot of time because everything is automatic now and we don't need to scan manually. This has saved considerable time and makes it easy to scan the whole project and find whatever issues exist.

Regarding additional features, the main focus was the ability to scan our project, CICD workflow, and other tools we are using to identify issues in the initial phases so that we can fix them easily and ensure our system has more comprehensive vulnerability scanning.

GitGuardian Platform has positively impacted our organization by helping to scan issues in early stages so that we can make decisions and fix them easily. It aids in automatic deployment whenever there is no vulnerability, allowing us to deploy our services without any impact or additional checks, thus saving a lot of time.

Earlier, when we had a security repository or CICD process, we were taking about four to five days to scan all those things and maintain documentation to reduce vulnerabilities and keys. However, with GitGuardian Platform, we have reduced that time to within a single day to perform all activities.

GitGuardian Platform is a better solution already, but we could enhance it further by incorporating more features using AI for better security scans instead of just offering guidelines.

For needed improvements, we could integrate with our source repository, whether it is GitHub, Bitbucket, or Git bucket, and we can do so easily using AI. We would just need to provide proper prompts to scan the whole repository, which could allow for fixing vulnerabilities during development before pushing to deployment.

I have been using GitGuardian Platform for the last two years.

GitGuardian Platform is reliable for us and has proven to be stable.

For scalability, GitGuardian Platform handles our requests very easily. We are a couple of developers working as a team, and we are using it at a high level without any issues related to scalability.

I have not connected with customer support yet because everything has been working fine.

Earlier, we were using some Git-related cloud tools for scanning, such as SonarQube for finding issues and fixing vulnerabilities. However, now we are using GitGuardian Platform, which is quite helpful.

My experience with GitGuardian Platform's pricing, setup cost, and licensing was straightforward. Everything mentioned in the document format was clear, and there were no issues.

We have seen a return on investment with GitGuardian Platform. The amount we spend yields full results whenever required, so it has been good.

Before choosing GitGuardian Platform, I did not evaluate other options. I was searching and found this platform to provide a better solution, which led me to utilize it.

I advise others considering GitGuardian Platform to proceed with it for integrating CICD tools, workflows, or source repositories, as it can help them in early development, ease their processes, and accelerate their workflow. I rate my overall experience with GitGuardian Platform as nine out of ten.

I mainly use GitGuardian Platform to monitor source code and repositories for exposed secrets and credentials. I identify leaked API keys or tokens and help prioritize and remediate those findings before they can be misused.

Recently, I used GitGuardian Platform to scan a repository, and it flagged an exposed API credential in the code. I reviewed the finding, verified where the credential was being used, removed it from the repository, rotated the affected credentials, and updated the code to use a secure secret management approach instead.

The best features for me are automated secret detection, repository monitoring, and clear alerts for exposed credentials. I also find the ability to prioritize findings and track remediation useful because it makes it easier to quickly identify high-risk secrets and ensure they are properly addressed.

The feature I rely on most day-to-day is automated secret detection and repository monitoring. It continuously helps identify exposed API keys, tokens, passwords, and other credentials across repositories, so I do not have to manually review every change for potential leaks. It is especially important in my workflow because I work with security testing and code review, and catching a credential early allows me to investigate and remediate it before it becomes a larger security issue.

GitGuardian Platform has improved our security posture by giving us better visibility into exposed secrets across repositories. It has also made my daily workflow more efficient because I can quickly identify, investigate, and remediate leaked credentials instead of relying entirely on manual code reviews. Overall, it has helped make secret detection a more consistent part of our deployment and security process.

One area that could be improved is reducing false positives and making it easier to quickly understand the context and severity of a detected secret. More detailed remediation guidance and additional customization for alerts and scanning rules would also make GitGuardian Platform even more useful for security teams managing a larger number of repositories.

I have been using GitGuardian Platform for the last nine months.

GitGuardian Platform is very stable.

GitGuardian Platform has been scalable for our use case. It works well with the number of repositories and code changes growing while continuing to provide visibility into potential secret exposures. This makes it suitable for teams that need consistent secret detection across a growing deployment environment.

Customer support is good.

My experience with the pricing and licensing was generally positive. The setup was straightforward, and I found the licensing model relatively easy to understand. The overall cost felt reasonable for the visibility and security value provided, although pricing can vary depending on the organization's requirement and scale.

I have seen a positive return on investment, mainly through time saved in identifying and investigating exposed credentials. GitGuardian Platform reduces the amount of manual effort required for secret detection and helps the security team respond to findings faster. I do not have a specific dollar amount or percentage to share, but the improved efficiency and earlier detection provide clear value in our security workflow.

I would recommend evaluating GitGuardian Platform if secret detection and credential exposure are important concerns for your organization. It provides useful visibility into repositories, helps identify exposed credentials early, and makes investigation and remediation more efficient. I would suggest starting with the areas most relevant to your deployment workflow and then expanding coverage as needed. I gave this review a rating of 10.

Our primary use case for GitGuardian Platform is preventing credentials and other sensitive secrets from being accidentally committed to source code or exposed through our development and CI/CD workflows. We experienced one or two incidents where our secrets were leaked through Git when developers accidentally committed them or they were exposed through the pipeline. This is crucial from an infrastructure perspective because our application interacts with many cloud services. For example, development and deployment environments can contain AWS access keys, API keys, database credentials, and JWT tokens. The problem is not always intentional credential exposure, as a developer can accidentally include credentials in a .env file, Terraform variable, Docker file, or CI/CD configuration and commit it to Git.

GitGuardian Platform is designed to detect hardcoded secrets in both repositories and CI/CD workflows, including historical repositories and new contributions. It supports integrations with GitHub, GitLab, Bitbucket, and Azure DevOps, all of which we use in our organization. Our precise use case is to detect secrets before they become a production security issue.

GitGuardian Platform fits into our workflow in many steps. The first step is repository secret scanning, the second is CI/CD pipeline production, the third is pull request scanning, and the fourth is historical scanning.

Since adopting GitGuardian Platform, the most significant improvement in our organization is moving secret security earlier in the development process. Previously, the workflow involved developers committing secrets, which remained in repositories, leading to manual discoveries by the security team, credential rotations, and further investigations. This process was burdensome and time-consuming. Now, we have automated detection where developers commit secrets, the scanner detects them, the security team receives findings, and the secrets are either removed or rotated, significantly shortening the time between exposure and detection. This reduces our reliance on developers to remember every possible security rule.

I recall scanning twenty repositories for any secrets manually when our first AWS account was hacked, which took me around four days. However, GitGuardian Platform saves all those four days of my manual work by automating this process.

In my experience, the best features of GitGuardian Platform include real-time secret detection, which is invaluable for catching credentials close to when they are introduced rather than finding them weeks later. The second feature is historical repository scanning. Additionally, it has CI/CD integration, can integrate with multiple Git platforms, offers custom detectors, provides context-aware detection, and allows for severity and prioritization of issues.

The first three features have saved us considerably, particularly the real-time secret detection, while we initially also depended on historical repository scanning. As a DevOps professional, CI/CD integration is critically important to me.

I would improve GitGuardian Platform by reducing false positives and streamlining remediation. I also desire stronger integration around issue management workflows. For instance, once a critical secret is detected, the ideal workflow should involve detection, ticket creation, owner assignment, credential rotation, verification, and closure. The more automated this process becomes, the fewer manual security work is required.

I have been using GitGuardian Platform for around one year.

My advice for others considering GitGuardian Platform is that for DevOps and cloud infrastructure teams, integrating secret detection into normal development and CI/CD workflows makes much more sense than relying entirely on manual security reviews. This tool is incredibly useful. I would rate this product a ten out of ten.