GitGuardian review

GitGuardian is a credential-security platform with a central monitoring and incident-remediation layer. It looks for exposed credentials across internal code, CI/CD, container registries, collaboration tools, public GitHub and developer machines. Security teams use it to investigate detections, assign owners and route incidents for remediation; its NHI Governance capability also inventories machine identities such as service accounts, API keys and AI agents.

The developer-facing component is ggshield, a CLI for placing secret checks into pre-commit, pre-push, IDE and AI coding workflows. The platform also lists GitGuardian Scout (ggscout), integrations, detectors and remediation playbooks. Custom (Enterprise) lists self-hosted deployment, while other plans are offered as managed plans. That makes GitGuardian a layer alongside source control, CI/CD and collaboration systems, rather than a replacement for a secrets manager: the vendor positions it as a way to find credentials that escaped vaults and help teams rotate or revoke them.

The named developer tool is ggshield, GitGuardian’s CLI. The homepage says it supports pre-commit, pre-push, IDE, AI coding tools and sessions, plus agent skills, plugins and MCP servers. That gives teams several places to add checks before code is committed or shipped. The platform also advertises integrations and a 10,000 API calls/month allowance on Starter.

GitGuardian’s homepage links to documentation, but does not name SDK languages or describe an API protocol. Confirm supported SDKs, authentication, endpoints and rate limits in the vendor’s docs before building a direct integration; the Starter allowance is a monthly quota, not a published per-second limit. For broader stack integration, the platform monitors code repositories, CI/CD, container registries, Jira, Slack and public GitHub. Remediation playbooks and auto-routing are intended to move detections to owners, rather than leave developers with an alert to handle manually. Verify which connectors and workflows are available on the plan you are evaluating.

Starter costs $0 per month and includes up to 25 developers, unlimited real-time scanning, up to 500 historical scan detections, 10,000 API calls/month and 1 GB of repository scanning capacity. That is a useful entry point, but it is not unlimited historical coverage or scan capacity.

Paid prices are not published: the pricing page lists contact sales, and no monthly or annual billing schedule is published. Teams (Business) includes up to 20 teams, repository scans up to 12 GB and remediation playbooks. Growth includes up to 10 teams, scans up to 12 GB, limited public secrets monitoring and SSO with SAML 2.0 and SCIM. Custom (Enterprise) raises repository scan capacity to 60 GB and lists unlimited teams, custom detectors, 12-month audit log retention and self-hosted deployment.

Endpoint Protection is an add-on for Teams and Growth, priced per endpoint per year, with rates not published; Premium Care is also an add-on. Ask about overages, endpoint rates and enterprise collaboration-tool scanning before budgeting.

The vendor does not publish a licence or source-availability statement for GitGuardian in its homepage text, so do not treat the platform or ggshield as open source without checking the relevant repository and licence. Custom (Enterprise) lists self-hosted deployment; the other listed plans do not list it. Confirm what self-hosting includes, such as upgrades, support and required infrastructure, before choosing that route.

The platform connects to repositories and collaboration tools and can route remediation through playbooks. That creates integration and workflow dependencies, even if detections themselves are portable to another system. The vendor does not describe data-export terms on the homepage. Ask how to export incidents, detector configuration, audit history and identity ownership data, and whether exports remain available after cancellation. A migration would also require replacing ggshield checks in developer workflows and rebuilding any integrations or remediation routing tied to GitGuardian.

Capacity and plan boundaries matter as coverage expands: Starter has 1 GB of repository scanning capacity, while Teams and Growth list scans up to 12 GB and Custom (Enterprise) up to 60 GB. Starter also limits historical detections to 500 and API calls to 10,000/month. Growth has limited public secrets monitoring; confirm how that scope is measured and what happens when a quota is reached. Ask the vendor about service commitments, API burst limits, incident retention and the support response included in your quote.

The homepage lists SAML 2.0 and SCIM for Growth, and 12-month audit log retention for Custom (Enterprise). GitGuardian says NHI Governance keeps secrets within the customer perimeter; discuss the exact data flows and deployment model with the vendor. In one Reddit thread about an accidentally pushed API key, commenters advised treating it as compromised and rotating it; one also recommended history cleanup. That is general incident advice, not feedback on GitGuardian. A scanner can find exposure, but it cannot make a leaked credential safe without revocation or rotation.