GitGuardian

GitGuardian is the #1 security app on the GitHub Marketplace. It monitors source code repositories for exposed secrets in real-time, detecting API keys, hardcoded passwords, certificates, and other credentials that developers accidentally commit to version control. Secret exposure is a leading supply chain attack vector, and GitGuardian treats it as a first-class problem.

The platform covers 550+ secret types and scans across GitHub, GitLab, Bitbucket, and collaboration tools like Slack, Jira, and Confluence. GitGuardian also validates whether detected secrets are still active, so teams can prioritize live credentials over expired ones.

What is GitGuardian?

GitGuardian catches secrets before they become incidents. When a developer commits an AWS key, database password, or API token to a repository, GitGuardian detects it within seconds and triggers an alert. The platform also scans git history, catching secrets that were committed and later deleted but remain in the repository’s commit log.

Beyond detection, GitGuardian now offers Non-Human Identity (NHI) governance and honeytoken intrusion detection. The ggshield CLI tool runs as a pre-commit hook to block secrets before they ever reach the remote repository.

Key features

Secret categories

Secrets detection engine

GitGuardian uses pattern matching combined with validation to detect 550+ secret types. Each finding is checked against the issuing service when possible to confirm the secret is still valid. This reduces false positives and helps teams focus on credentials that are actually exploitable.

ggshield CLI

The open-source CLI tool plugs into pre-commit hooks, GitHub Actions, GitLab CI, Bitbucket Pipelines, and other CI systems. It scans commits on each push and blocks merges if secrets are found.

# Install ggshield
pip install ggshield

# Set up pre-commit hook
ggshield install --mode local

# Scan a repository
ggshield secret scan repo .

# Scan in CI
ggshield secret scan ci

Honeytoken detection

GitGuardian can generate honeytokens (fake credentials) that you plant in repositories, cloud environments, or internal systems. When someone uses a honeytoken, GitGuardian alerts you immediately, providing early warning of unauthorized access or a breach.

Historical scanning

Scanning is not limited to new commits. GitGuardian checks the full git history of a repository, finding secrets that were committed months or years ago. Even if the secret was “deleted” in a later commit, it remains in git history and can be exploited.

Collaboration tool scanning

Beyond code repositories, GitGuardian scans Slack messages, Jira tickets, and Confluence pages for exposed credentials. Developers often paste secrets into chat or documentation without thinking about the security implications.

Setup

CI/CD integration

GitHub Actions

name: GitGuardian Secrets Scan
on: [push, pull_request]

jobs:
  scanning:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: GitGuardian scan
        uses: GitGuardian/ggshield-action@v1
        env:
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}

GitLab CI

ggshield-scan:
  image: gitguardian/ggshield:latest
  script:
    - ggshield secret scan ci
  variables:
    GITGUARDIAN_API_KEY: $GITGUARDIAN_API_KEY
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

When to use GitGuardian

GitGuardian is the go-to choice for secrets detection. If you have developers committing code to repositories, you almost certainly have leaked secrets somewhere in your git history.

Strengths:

• 550+ secret types with active validation
• Pre-commit blocking via ggshield prevents incidents
• Historical scanning catches old secrets still in git history
• Slack, Jira, Confluence scanning beyond code
• Free tier for individual developers

Limitations:

• Primarily focused on secrets detection, not general SCA
• NHI governance and advanced features require paid plans
• Enterprise features (SSO, custom detectors) are commercial only

How it compares:

Further reading: Supply Chain Attacks Guide | Software Supply Chain Security

Frequently Asked Questions