✅ 350+ types of specific and generic secrets supported with high accuracy level.

✅ Checks the validity of 200+ types of exposed secrets.

✅ 100+ IaC security policies available out-of-the-box.

✅ Public documentation claims 2,500+ built-in detectors, but no detailed list is provided.

❌ Validity checks are not available.

✅ 300+ IaC security policies with extensive support for AWS, GCP, Azure, K8S, and more.

Regular expressions result in fewer false alerts. Additionally, known patterns make it simpler to verify if the secret is true or false or whether this is a test or example key.

Learn more about how GitGuardian detects secrets.

++ Yes, based on the combination of entropy checks and contextual analysis of the presumed secret (pre/post-filters).

++ GitGuardian currently supports 13+ types of generic secrets.

✅ Generic secrets are found using machine ML-based detectors. The docs regroup generic secrets under the Private keys category, without any additional details.

In order to capture a considerably wider variety of secret types, high entropy should be employed.

Learn more about how GitGuardian detects secrets.

++ Yes, supported with the use of regular expressions (in SaaS/Self-hosted versions).

✅ Supported, through regular expression syntax.

To find company-specific secrets that are not picked up by the default patterns, you should be able to define your own patterns.

Learn how to create custom detectors.

++ Detectors can be individually activated/deactivated from the UI, in the workspace settings.

🟠 Detectors can be deactivated from the spectral.yaml configuration file.

We recommend keeping all detectors active to avoid missing any hardcoded secrets.

Learn how to configure GitGuardian’s detectors.

++ 22 file names raise policy break alerts.

🟠 The documentation mentions policies for detecting sensitive file names without going into any details.

There is a very lengthy list of extensions that potentially hold secrets due to the numerous programming languages, frameworks, and coding standards that are used globally.

Learn which file types contain sensitive information.

++ 14 extensions raise policy break alerts.

🟠 The documentation mentions policies for detecting sensitive file extensions without going into any details.

Secrets are frequently discovered in file extensions together with environment variables and configuration data. Learn more.

++ Yes, excluding paths is possible through the UI. GitGuardian recommends a set of exclusions (e.g. test directories) and enables users to test filepaths against the active exclusion list.

✅ Filepath exclusion for built-in detectors needs to be declared in a spectral.yaml configuration file.

The ability to reduce the number of incidents and concentrate solely on those that matter most is critical to scaling your secrets detection and remediation program.

++ Secrets scanning is possible for local Git repositories or repositories managed through GitHub, GitHub Enterprise, GitLab, Azure DevOps, and Bitbucket Server/Data Center.

🟠 Secrets scanning is possible for local Git repositories or repositories managed through GitHub, GitHub Enterprise, and GitLab.

Your repositories contain secrets and sensitive data, such as user passwords or other security flaws, making it possible for anybody with access to the image to obtain that secret and perhaps exploit it to gain access to other systems.

Learn more on why secrets inside Git are a problem

++ Yes, Docker images can be scanned with the GitGuardian CLI, ggshield, using a specific command. The Dockerfile, build arguments, and the image's layers' filesystem are scanned for secrets.

❌ Not supported.

Your Docker image can wind up containing a private SSH key, an AWS access token, or a password.

Learn more about the secrets we found on Docker Hub.

🟠 The GitGuardian REST API and CLI, ggshield, support scanning all types of text input for secrets. GitGuardian can provide wrappers (code snippets) to extract and load data from observability tools or CI/CD logs.

🟠 The Spectral Scan CLI supports scanning all types of text input for secrets. Users need to build their own connectors to observability tools to extract and scan data on demand or continuously.

Sensitive data may unintentionally leak from your server logs when services unintentionally output sensitive data.

🟠 The GitGuardian REST API and CLI, ggshield, support scanning all types of text input for secrets. GitGuardian can provide wrappers (code snippets) to extract and load data from tools like Slack, Jira, GitHub issues, etc.

🟠 The Spectral Scan CLI supports scanning all types of text input for secrets. Users need to build their own connectors to observability tools to extract and scan data on demand or continuously.

Sensitive data may unintentionally be leaked in other productivity tools used by developers.

++ Yes

🟠 No native GitHub app available. Users have to build a GitHub app and deploy a serverless function on AWS Lambda.

✅ Point and scan using the CLI is possible, however.

++ Yes, native GitHub App at the organization level (one-click integration).

🟠 No native GitHub app available. Users have to build a GitHub app and deploy a serverless function on AWS Lambda. Point and scan using the CLI is possible, however.

++ Yes, upon integration of a GitHub Enterprise organization, admins can choose to - give access to select repositories - provide access to all repositories (present and future repositories).

🟠 No native GitHub app available. Users have to build a GitHub app and deploy a serverless function on AWS Lambda.

✅ Point and scan using the CLI is possible, however.

++ Yes, native GitHub App available. Admins can:
- give access to select repositories
- give access to all repositories (present and future repositories).

🟠 No native GitHub app available. Users have to build a GitHub app and deploy a serverless function on AWS Lambda.

✅ Point and scan using the CLI is possible, however.

++ Yes, a native integration is available. GitGuardian needs a Personal Access Token with an Admin scope.

🟠 No native GitLab integration available. Users have to build a GitLab bot and deploy a serverless function on AWS Lambda.

✅ Point and scan using the CLI is possible, however.

++ Yes, a native integration is available. GitGuardian needs a Personal Access Token with an Admin scope to establish a webhook with the VCS for historical and real-time scanning.

🟠 No native GitLab integration available. Users have to build a GitLab bot and deploy a serverless function on AWS Lambda.

✅ Point and scan using the CLI is possible, however.

++ Yes, a native integration is available. GitGuardian needs a Personal Access Token with an Admin scope to set up a webhook with the VCS for historical and real-time scanning.

❌ Not supported.

++ Yes, a native integration is available. GitGuardian needs a Personal Access Token with an Admin scope to set up a webhook with the VCS for historical and real-time scanning.

❌ Not supported.

++ Yes, a native integration is available. GitGuardian needs a Personal Access Token with an Admin scope to set up a webhook with the VCS.

❌ Not supported.

++ Yes, a native integration is available. GitGuardian needs a Personal Access Token with an Admin scope to set up a webhook with the VCS.

❌ Not supported.

++ Yes, full repository history scan can be launched on-demand. Scanning is performed across all branches and for the entire history up to the initial commit.

✅ Yes, historical scans are run using a CLI command (called "audit mode").

Hardcoded secrets can hide deep in the commit history across various branches, not only the latest revision of the code.

++ Yes, supported through the GitGuardian CLI, ggshield.

✅ Yes.

Pre-commit hooks put the onus on developers to keep their code free from secrets before contributing to the team’s codebase. The cost of remediation at this stage is low. Learn how to set up a pre-commit hook with GitGuardian.

++ Yes, supported through the GitGuardian CLI, ggshield.

✅ Yes.

Pre-push hooks put the onus on developers to keep their code free from secrets before contributing to the team’s codebase.

++ Yes, supported through the GitGuardian CLI, ggshield.

In addition, a 'break-glass' option is provided to avoid blocking developer workflow in case test credentials or false positives are raised.

✅ Yes.

Pre-receive hooks are the most effective tool to prevent secrets from reaching your codebase.

✅ Yes, supported with the native VCS integrations (GitHub, GitLab, Bitbucket and Azure DevOps). Historical and continuous protection.

🟠 Not supported natively.

Learn more about how Git hooks can be useful in a secure development.

++ Yes, the GitGuardian CLI, ggshield, runs natively with 8 different providers in total: GitHub Actions, GitLab CI/CD, Bitbucket pipelines, Azure pipelines, Jenkins CI, CircleCI, Drone CI, and Travis CI.

✅ Yes.

It is important to raise awareness around the problem of hardcoded secrets and align Dev, Sec, and Ops with Automated Security Testing (AST) in pipelines.

Learn how to use GitGuardian's secrets detection in your CI workflows.

++ In GitHub, secrets scanning check runs can be triggered on pull requests on repositories monitored by GitGuardian. The behavior can be configured to block merging PRs containing secrets.

🟠 Not supported natively. Users have to build a GitHub app and deploy a serverless function on AWS Lambda to continuously scan code in real-time (new commits and pull requests).

Pull request or merge request scanning brings secrets detection to environments developers are familiar with, such as the GitHub or GitLab UI.

++ Unified view of incidents across all monitored sources found via the native VCS integrations.

🟠 Unified view of incidents across all monitored sources, as declared by the user. The view may be incomplete.

It facilitates the collection of relevant data for big-picture analysis.

++ Rich UI/centralized dashboard for Security and Incident Response teams.

✅ UI/centralized dashboard for Security and Incident Response teams.

To accurately assess the code security posture of an enterprise, security professionals require visibility across complex, sprawling environments.

++ Developers can get access to incidents via the GitGuardian UI, with a scoped view on incidents shared with them.

++ An external page can be generated for the developers to view individual incident details, fill out a feedback form and possibly remediate the incident on their own with our advice.

❌ No restricted developer view.

Developers can view and handle their incidents most effectively with the help of intuitive dashboards.

✅ In addition to data such as the commit sha, date, author, secrets type, location (repository, file name, line) and validity, GitGuardian provides contextual tags such as "from a historical scan", "sensitive file", "test file", "exposed publicly", "leaked publicly", "regression", "default branch", etc. 

🟠 SpectralOps provides basic incident metadata and links to the VCS for further investigation.

❌ Incident details pages (per incident) are not available.

Incident data helps you in prioritizing and investigating incidents better by giving additional context.

++ GitGuardian scores the severity of incidents: "Low", "Medium", "High" or "Critical" following default rules or user-defined rules.

✅ Yes.

Severity scoring will assist in identifying and prioritizing issues for quicker resolution.

++ For certain secrets, GitGuardian can perform non-intrusive checks to verify their validity. When revoked, secrets will be marked as no longer valid, effectively providing proof of remediation.

++ GitGuardian can also verify the presence of the secrets in the commits and provide proof of deletion after all evidence of the secret is removed.

❌ Not supported.

Users should be able to check the validity of each incident and determine whether the leaked secret is still present or has been entirely erased from the commit history. Learn how to verify if an exposed secret was removed from the commit history.

++ GitGuardian groups all occurrences of the same secret leak across files, repositories, and organizations.

🟠 SpectralOps limits the display to first occurrence of an exposed secret incident.

You can lessen alert fatigue. There is no need to triage/resolve each and every occurrence separately.

++ Incident handling with "Triggered", "Assigned", "Resolved" and "Ignored" statuses. Two outcomes are possible: incidents can be resolved or ignored.

✅ Yes, incidents can only be “Ignored” or “Resolved”.

This will assist organizations in swiftly identifying incidents and mitigating their negative impact.

++ Incidents can be assigned to a team member (a security engineer or a developer) to handle the incident.

✅ Incidents can be assigned to a team member (a security engineer or a developer) to handle the incident.

Defining incident assignees makes sure that the incident gets a timely and appropriate response.

++ Default remediation guidelines and recommendations are displayed in the UI. The guidelines can also be customized.

🟠 Default remediation guidelines and recommendations are described in the documentation.

You have some remediation guidelines by default. But as each organization has its own context and remediation policies, you will have the ability to customize the remediation guidelines.

Learn how to create custom remediation guidelines.

++ Incident remediation playbooks like sharing incidents with involved developers, collecting feedback, and closing incidents when they are re-checked as invalid can be automated.

❌ Not available.

The time savings, particularly at the enterprise scale, can be significant. Playbooks keep your teams productive and focused!

Learn more about how to prioritize, investigate and remediate hardcoded secrets incidents at scale.

++ A detailed timeline is provided with an extensive activity log of all performed events (status changes, feedback notes, access sharing, and much more).

❌ Not available.

Timelines help security teams keep track of all of the actions performed on the incident.

++ Developers can get access to incidents via:
• GitGuardian workspace, scoped view on incidents shared with them;
• A link to an external page can be generated for the developers to view individual incident details, fill a feedback form and possibly remediate the incident on their own.

🟠 Members can be invited to the SpectralOps workspace but developers do not have specific roles or views.

Because developers are key to taming secrets sprawl, AppSec teams must provide them with instant access to and ownership of their hardcoded secrets incidents.

Learn how to bring Dev, Sec, and Ops together for tackling secret sprawl.

++ Yes. When ignoring incidents, it is possible to flag findings as false positives, low-risk credentials, or test credentials.

✅ Yes. When ignoring incidents, it is possible to flag findings as false positives.

Pull request or merge request scanning brings secrets detection to environments developers are familiar with, such as the GitHub or GitLab UI.

++ New occurrences of a resolved incident can be configured to re-open the incident and trigger new alerts or deliver silent notifications.

❌ Not available.

If new secrets were added or rotated secrets broke existing app functionality, you need to reopen the incident.

++ Yes

✅ Yes.

Serious incidents are immediately identified. Alerts may be directed to the right developers more rapidly for remediation.

++ Yes, to prevent alert fatigue, only one email is sent for multiple occurrences of the same incident.

🟠 Daily or weekly email recap.

The problem of secret leaks has developers at the forefront. It is crucial to notify the developer in charge of the incident via their commit email.

‍Learn what's included in GitGuardian email alerts.

++ Yes

✅ Yes.

Teams, processes, and tools should be integrated to increase efficiency and effectiveness for all users by ensuring that alerts are received at the appropriate time and location and that no alert is missed.

++ Yes

✅ Yes.

By integrating your code security platform and ticketing/messaging tool, you can address critical incidents and expedite remediation.

++ Yes

❌ No event-driven generic webhooks

Stay in the know with event-driven alerts when new incidents are raised or when actions are performed on open incidents.

++ Yes, enriched analytics to assess security posture over time and remediation performance.

✅ Yes, reports are an overview of all active issues but do not provide an assessment of security posture or cover remediation performance.

Analytics help you assess security posture over time, and remediation performance.

++ All data is exportable in .csv (including historical incidents) or in JSON format using the REST API.

✅ Yes, data can be exported in .csv or .pdf format.

Your Dev can review the incident data and filter it further based on their needs.

++ SaaS & On-premises (self-hosted)

✅ Hybrid deployment model, runnable self-hosted binary and a cloud-hosted dashboard.

SaaS is less expensive and easier to scale, while on-premises offers more visibility.

See how an enterprise customer deployed a secrets detection program.

++ Yes, fully compatible with any SAML 2.0 provider.

✅ Yes, fully compatible with any SAML 2.0 provider.

Because users only log in once per day and utilize a single set of credentials, it decreases the number of attack surfaces.

See the setup procedures for different IdPs.

++ Yes, the available roles "Workspace Owner", "Manager" (admin), "Member" and "Restricted" are designed for fine-grained access control down to the occurrence level. Teams management available.

🟠 Team creation and management is available. No specific roles with pre-defined permissions are available.

It's a wonderful approach to bring in every developer, scale up incident remediation, and deal with orphan incidents.

Learn how RBAC can help fix hardcoded credentials faster.

++ Detailed activity logs of all actions triggered on the dashboard or through the REST API.

❌ Not available.

Audit logs include precise historical data that can be used to retrace an incident's timeline.

See how to access Gitguardian audit logs.

++ GitGuardian’s public REST API can be used to realize all sorts of actions on your workspace and incidents (retrieve, assign, update status, and share secrets incidents, and more).

✅ Yes.

This API provides you with access to all of the incident data, including tasks.

++ A dedicated team of Solutions and DevOps Engineers will be made available to help you rollout secrets detection and remediation for your organization (included in the licensing model, at no additional cost).

🟠 Unknown.

In order to use a product effectively, a solid onboarding program aids in your ability to comprehend and experience the value it offers.

It is always advantageous to have support professionals who are completely committed to fixing any technical issues you may encounter.

Read more in-depth articles on GitGuardian Blog.