GitGuardian

GitGuardian is a security platform focused on one persistent problem: secrets that end up where they should not be. API keys, database passwords, cloud credentials and tokens are routinely committed to Git, pasted into tickets or baked into container images. GitGuardian scans those places, raises an incident when it finds a live credential, and helps the team revoke and rotate it.

The company was created in Paris in November 2017 as a side project that watched public GitHub commits in real time. It now reports more than 610,000 users and describes itself as the top security app on the GitHub Marketplace.

Key features

• Internal secrets monitoring. Real-time and historical scanning of repositories on GitHub, GitLab, Bitbucket and Azure DevOps, with higher tiers adding CI/CD, container registries and collaboration tools such as ticketing and documentation systems.
• ggshield CLI. An open-source command-line tool that blocks secrets in pre-commit, pre-push and pre-receive hooks and runs in GitHub Actions, GitLab pipelines, Jenkins, CircleCI, Azure Pipelines, Bitbucket Pipelines, Drone CI and Travis CI.
• Validity checks and prioritisation. Incidents show whether a leaked credential is still valid, and paid plans add AI risk scoring and false-positive filtering.
• Remediation workflows. Playbooks and notifiers send incidents to Slack, Microsoft Teams, email, Jira and ServiceNow, with PagerDuty, Splunk and custom webhooks also supported.
• Public monitoring and honeytokens. Enterprise customers can watch public GitHub for leaks tied to their organisation and plant decoy credentials that alert when used.
• Non-human identity governance. An inventory of machine credentials with ownership mapping, reused-secret detection, secrets-manager integration and push-to-vault.

Who it is for

GitGuardian is built for development teams and the security engineers who support them. Small teams can start on the free plan to catch leaks in their repositories; larger organisations with many repositories, CI systems and compliance needs use the Growth or Enterprise tiers, which add SSO, SCIM, EU or US data hosting and self-hosted deployment.

Pricing at a glance

• Starter: $0 for up to 25 developers, with unlimited real-time scanning, up to 500 historical scan detections and 10,000 API calls per month.
• Growth: priced through sales; up to 10 teams, SSO and SCIM, remediation integrations and limited public monitoring.
• Enterprise: custom pricing with unlimited teams, public monitoring, NHI governance, custom detectors and self-hosting.

A trial of the paid platform can be requested from the pricing page. Plans are as listed at the time of writing (October 2026); check the vendor's pricing page before buying.

Things to consider

• GitGuardian detects and helps remediate secrets; it is not a vault, so you still need a secrets manager to store credentials.
• Paid prices are not published, so budgeting needs a sales conversation.
• The free plan limits historical detections and gives only limited ggshield and pre-commit features.

Getting started

1. Sign up for the free Starter plan on the GitGuardian pricing page and connect your Git provider.
2. Review the historical incidents and rotate any credentials still valid.
3. Install ggshield as a pre-commit hook and add it to CI, following the GitGuardian documentation.
4. Route new incidents to the chat or ticketing tool your team already uses.