GitGuardian is a secrets security and non-human identity (NHI) governance platform. Founded in Paris in 2017 and led by co-founder and CEO Eric Fourrier, the company started by detecting API keys, tokens and passwords leaked in source code, and has expanded into managing the lifecycle of the non-human identities those secrets belong to, including service accounts, applications and AI agents. Its platform finds exposed secrets across development tools and collaboration platforms, inventories secrets held in vaults and CI/CD systems, links them to the identities and permissions they grant, and supports remediation from detection through to rotation. This overview explains how the platform works and what it covers, based on GitGuardian’s public product documentation and announcements.
At A Glance
| Vendor | GitGuardian, founded 2017, Paris |
|---|---|
| Category | Secrets security, NHI governance, AI agent credential security |
| Identities covered | Service accounts, applications, workloads, AI agents and the secrets they use |
| Deployment | SaaS or self-hosted |
| Detection coverage | More than 550 secret detectors, with validity checks for many secret types |
| Agentic AI | AI Hooks for coding agents, AI agent and MCP server inventory, GitGuardian MCP Server |
| Funding | $50 million Series C (February 2026) led by Insight Partners; $106 million raised in total |
What The Platform Does
GitGuardian’s platform combines two product areas, Secrets Security and NHI Governance, which share a single detection engine and incident workflow.
Secrets Detection
GitGuardian scans for secrets wherever developers and teams work. Internal Monitoring covers:
- Source code and full commit history in GitHub, GitLab, Bitbucket and Azure DevOps
- Collaboration tools including Slack, Microsoft Teams, Jira and Confluence, with historical scanning for Jira and Confluence Cloud
- Container images and other software artefacts
- Developer workstations and CI pipelines through the
ggshieldcommand-line tool
The detection engine combines more than 550 specific detectors with generic detection for secrets that do not match a known format. Validity checks test whether a detected credential is still active, so teams can prioritise live exposures.
Public Monitoring
Public Monitoring watches public GitHub for secrets linked to an organisation’s employees, repositories and domains, including secrets leaked from developers’ personal repositories. GitGuardian also runs HasMySecretLeaked, a free service that lets anyone check whether a secret has appeared in public GitHub without revealing the secret itself.
Honeytokens
Honeytokens are decoy credentials that can be placed in code repositories, CI pipelines and other systems. Any attempt to use a honeytoken triggers an alert with details about the source, giving early warning of an intrusion or a leak.
Shift-Left Prevention
ggshield runs as a pre-commit and pre-push hook and in CI/CD pipelines, blocking secrets before they reach a shared repository. It can scan files, directories, Docker images and Git history, and is configured centrally with a single command per machine.
NHI Governance
NHI Governance extends GitGuardian from finding leaked secrets to managing the identities behind them.
Inventory
A lightweight collector called ggscout runs inside the customer’s environment and builds an inventory of secrets and identities across production infrastructure. It sends hashes and metadata to GitGuardian rather than raw secret values. Documented sources include:
| Secrets managers | HashiCorp Vault, including Enterprise namespaces, Azure Key Vault, AWS Secrets Manager, Google Secret Manager, Delinea Secret Server and Akeyless |
|---|---|
| CI/CD systems | GitHub Actions and GitLab CI/CD variables |
| Infrastructure | Kubernetes secrets |
| Cloud IAM and identity providers | AWS IAM, Microsoft Entra ID, Okta, Auth0, Datadog and Snowflake |
ggscout is available as a binary, a Python package, a Docker image and a Helm chart. Since September 2026, it classifies every collected value with the same detection engine used for code scanning, so the inventory can distinguish real credentials from placeholders or configuration values.
Identity Map And Risk Context
NHI Governance links each secret to the identity it belongs to and to the permissions that identity holds. For example, an AWS access key stored in a vault or in Kubernetes is linked to its AWS IAM identity. The platform flags admin-level and overprivileged NHIs across AWS IAM, Microsoft Entra ID and Okta, and automatically raises the severity of incidents that affect privileged identities. Teams can see where each secret is stored and used, how old it is, whether it is inactive, and whether it has also leaked into code or collaboration tools.
Policies And Remediation
NHI Governance applies policies to the inventory, such as secrets that are unvaulted, unrotated, shared across environments, or leaked as well as vaulted. Through ggscout, GitGuardian can also write secrets found in code into a secrets manager, which supports moving hard-coded credentials into a vault. Read and write support depends on the integration; HashiCorp Vault supports both, for example, while Azure Key Vault is read-only.
How The Architecture Works
| Component | What it does |
|---|---|
| GitGuardian platform | The platform hosts the detection engine, incident management, the NHI inventory and the policy engine. It is available as SaaS or as a self-hosted deployment for organisations that need to keep data in their own environment. |
| Source integrations | Version control systems and collaboration tools connect to the platform directly through native integrations, so new commits and messages are scanned continuously. |
| ggshield | The command-line tool runs on developer machines and in CI/CD pipelines to stop secrets before they are committed or deployed. |
| ggscout | The collector runs in the customer’s infrastructure, reads from vaults, CI/CD systems, Kubernetes and identity platforms, and sends inventory data to GitGuardian. Some integrations run in place; for example, the GitHub Actions collector runs inside a workflow and inventories organisation, repository and environment secrets. |
Agentic AI Capabilities
GitGuardian approaches AI agents as both a source of secret leaks and a new class of non-human identity.
AI Hooks For Coding Agents
AI Hooks run inside AI coding tools and block secrets before they are sent to a model. GitGuardian documents hooks for coding agents including Claude Code, Cursor, GitHub Copilot, OpenAI Codex and Mistral Vibe, and ggshield can configure hooks for every detected agent on a machine with one command.
AI Agent And MCP Inventory
Released in September 2026, the AI agents and MCP inventory shows which AI agents and MCP servers are running on each developer endpoint, whether AI Hooks are installed, and includes agents running under personal subscriptions. It requires ggshield 1.54.0 or later and the Endpoints licence entitlement.
GitGuardian MCP Server
The GitGuardian MCP Server brings secrets detection and incident data into AI-enabled IDEs, so developers and agents can scan code and review incidents from within their assistant.
AI Agent Credentials
NHI Governance tracks the credentials used by AI systems in the same inventory as service accounts and applications, and GitGuardian has stated that it is expanding coverage to detect, monitor and govern credentials used by AI systems, from coding assistants to customer service bots.
Integrations
| Area | Documented integrations |
|---|---|
| Version control | GitHub, GitLab, Bitbucket, Azure DevOps |
| Collaboration | Slack, Microsoft Teams, Jira, Confluence |
| CI/CD | GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines and others via ggshield |
| Secrets managers | HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, Delinea, Akeyless |
| Identity and cloud | AWS IAM, Microsoft Entra ID, Okta, Auth0, Snowflake, Datadog |
| AI tools | Claude Code, Cursor, GitHub Copilot, OpenAI Codex, Mistral Vibe, MCP-compatible IDEs |
Use Cases And Industries
GitGuardian publishes use cases for detecting and remediating leaked secrets in code and collaboration tools, preventing secrets from being committed, monitoring public exposure, detecting intrusions with honeytokens, inventorying and governing NHIs across vaults and cloud IAM, migrating hard-coded secrets into vaults, and securing developer use of AI coding tools. GitGuardian describes itself as the number one app on the GitHub Marketplace and publishes an annual State of Secrets Sprawl report based on its scanning of public GitHub. Its Series C funding is directed partly at expanding in DACH, the UK, France and the Nordics, where regulation increasingly requires secrets and NHI security.