Where GitGuardian stands in the landscape
The proliferation of cloud services has expanded the attack surface for cybercriminals. According to IBM’s 2023 Cost of a Data Breach, 82% of breaches involved data stored in the cloud.11
One of those cloud storage services is well known to developers: GitHub. GitHub neither created nor owns Git, a popular tool for version control, source code management, and code collaboration. It is, however, the most popular Git service provider in the world.
In 2017, two French data scientists notes that their contemporaries often included plain-text credentials in the scripts and apps they wrote and they wanted to see how common it was. Since GitHub has one of the largest collections of publicly available source code in the world, they decided to scan it for credentials.
As they refined their algorithms to catch more and weed out false positives, the numbers grew more shocking. In their 2024 State of Secrets Sprawl report, GitGuardian found over 12.8 million new instances of secrets committed to GitHub repositories in 2023, an increase of over 28% from the prior year.
When the French scientists first discovered this in 2017, they started letting people know that their passwords, API keys, and other secret credentials were sitting in public view on GitHub and soon signed their first customer for a tool to detect and prevent secrets sprawl. That was how GitGuardian came into being and found its first client.
Since then, GitGuardian has built hundreds of specific detectors, provides free services to smaller developer teams, and helps clients ranging from SMBs to Fortune 500 companies find, remove, remediate, and prevent exposed credentials in their source code.
GitGuardian has expanded and improved its offering and services. It now provides the following:
- Both cloud and on-premises solutions for detecting and remediating leaked secrets
- The ability to scan multiple types of software artifacts and developer tools for secret leaks
- Honeypot credentials called honeytokens to help detect when/where hackers find your secrets
