What I like best is the secret detection across our Git history. When we ran a historical scan on one of our repositories it surfaced real exposed credentials we had no idea were sitting in the commit history. The alerts are clear and actionable, which made planning the remediation (rotating the secrets and rewriting the Git history) much easier. Onboarding a repo was quick and the scan reports are easy to share with the rest of the dev team. Review collected by and hosted on G2.com.

Remediating secrets that are already committed to history still takes manual work on our side (rotating the credential and rewriting the Git history), which can be intimidating for smaller teams. I'd love even more guided or partly automated remediation steps directly from the dashboard. The volume of alerts can also feel like a lot at first until you tune what matters. Review collected by and hosted on G2.com.

this week it literally saved me from committing a real secret in a small personal Python project. It caught the credential immediately and showed me exactly where it was and how to rotate it. That kind of fast feedback is the main value: it scans commits and PRs in real time, integrates cleanly with GitHub, and gives actionable remediation steps instead of just raising an alarm. It’s very developer-friendly and doesn’t slow down your workflow Review collected by and hosted on G2.com.

initial tuning takes some time to reduce false positives and configure ignore rules for non-sensitive test data. Some advanced reporting and bulk management features could be more streamlined in the UI Review collected by and hosted on G2.com.

It’s good at finding secrets that have accidentally been included in MRs. Review collected by and hosted on G2.com.

It’s not very good at finding SAST static issues in the MR. Review collected by and hosted on G2.com.

it is very easy to implement and does not require heavy configuration to start delivering value. The onboarding process is straightforward, and integrations with GitHub and CI/CD pipelines work smoothly, allowing teams to get up and running quickly. I use GG frequently as part of daily development and code review workflows, and it fits naturally without slowing anyone down.

Customer support has been responsive and helpful whenever clarification or guidance was needed, especially during initial setup and alert tuning. The accuracy of secret detection, combined with clear alerts and remediation guidance, makes it a practical security tool that developers actually trust and consistently use. Review collected by and hosted on G2.com.

The pricing may seem somewhat steep for smaller teams or early-stage startups, particularly when expanding usage to multiple repositories. At first, some alerts might need to be adjusted to minimize unnecessary notifications, which involves a bit of a learning curve. Furthermore, the advanced features and options for policy customization could offer greater flexibility, especially for organizations that have highly specific internal security processes. Review collected by and hosted on G2.com.

The Secret internal incidents notification is quick and helpful, and the UI is easy to understand if you have experience with similar tools. Review collected by and hosted on G2.com.

Honestly, I haven’t had any inconveniences. I use GitGuardian to get quick reports when a secret is public, and for that it’s been incredible. Review collected by and hosted on G2.com.

GitGuardian gives me a quick alert when I accidentally push my credentials to GitHub. Review collected by and hosted on G2.com.

I don’t particularly think there’s anything I don’t like about GitGuardian. Review collected by and hosted on G2.com.

How quickly it happens in everyday life that one overlooks a password or other "secret data" in a commit. It's good that GitGuardian alerts you when the commit is also pushed. Review collected by and hosted on G2.com.

I have not noticed any disadvantages of GitGuardian yet. Review collected by and hosted on G2.com.

Gitguardian is a comprehensive code security platform primarily designed to detect and remediate hardcoded secrets (API keys, credentials, certificates) and manage Non-Human Identities (NHIs) in software development. It is widely used to prevent security breaches caused by leaked credentials in source code and DevOps pipelines. Review collected by and hosted on G2.com.

I have found no downsides of using GitGuardian. Review collected by and hosted on G2.com.

GitGuardian is very helpful for finding secrets and PII that might otherwise get pushed to remote repositories. I think yes Review collected by and hosted on G2.com.

It does not currently provide the option to run SAST scans, so having static code analysis available here would be a nice addition. Review collected by and hosted on G2.com.

GitGuardian helps detect exposed secrets, such as API keys and credentials, in repositories very quickly. The alerts are clear, and the dashboard is easy to understand, making it simpler for developers to identify and fix security issues faster. Review collected by and hosted on G2.com.

At times, the alerts can feel a bit overwhelming, especially for new users. It can also take a little while to get familiar with the dashboard and fully understand all of its features. Review collected by and hosted on G2.com.