GitGuardian is a secrets security and non-human identity (NHI) governance platform. It helps security and engineering teams find API keys, tokens and passwords that have leaked into code, collaboration tools and developer machines, fix them, and then govern the service accounts, applications and AI agents those secrets belong to.
The company began with secrets detection in source code and now covers the whole credential lifecycle: detection, prevention before commit, an inventory of vaulted secrets, the identities and permissions behind them, and remediation through to rotation.
At A Glance
| Vendor | GitGuardian |
|---|---|
| Category | Secrets security and non-human identity governance |
| Identities covered | Secrets, API keys, OAuth tokens, service accounts, applications, workloads, AI agents |
| Deployment | SaaS, SaaS with GitGuardian Bridge, or self-hosted (including air-gapped) |
| Agentic AI | AI Hooks for coding agents, AI agent and MCP inventory, GitGuardian MCP Server (beta) |
| Funding | A reported $106 million raised in total |
| Customers | Deutsche Telekom, BASF, Orange, Snowflake, ING |
What GitGuardian Does
Machine credentials such as API keys and tokens spread through repositories, pipelines, containers, chat tools, laptops and AI coding assistants faster than teams can track them. A single leaked key can open a production system, and modern compliance frameworks expect organisations to show they control secrets and machine identities.
GitGuardian answers this in two connected product areas that share one detection engine and one incident workflow. Secrets Security finds exposed credentials, inside the organisation and on public GitHub, and stops new ones from being committed. NHI Governance takes the next step: it inventories the secrets held in vaults and CI/CD systems, links each one to the identity and permissions it grants, and applies policy to that inventory so risky credentials can be found and cleaned up.
Products
Internal Secrets Monitoring
Application security teams need to know which credentials have already leaked into their own code and tools, and which of those still work. Internal Monitoring scans source code and full commit history, collaboration tools, container images and other artefacts for hardcoded secrets. More than 550 specific detectors work alongside generic detection for credentials with no known format, and validity checks against the issuing provider show which exposures are still live. Connecting a source replays its git history, and Jira and Confluence Cloud can be scanned historically. Incidents are assigned automatically with rotation playbooks per detector.
Public Secrets Monitoring
Public Monitoring watches public GitHub for secrets tied to an organisation’s employees, repositories and domains, including leaks from developers’ personal repositories, a common route for corporate credentials to end up in public. It suits security teams that need early warning when company secrets surface outside their control. The free HasMySecretLeaked service lets anyone check whether a secret has appeared on public GitHub without revealing the secret.
Developer Endpoint Protection
Secrets also sit in local files, environment variables and AI tool caches on laptops, where repository scanning cannot see them. Developer Endpoint Protection scans credentials on developer machines and in AI agent caches, and blocks new leaks through ggshield and AI Hooks.
Ggshield
The GitGuardian CLI, ggshield, stops leaks before they happen, including secrets slipping into pipelines and container images. It runs as a pre-commit and pre-push hook and in CI/CD pipelines, blocking secrets before they reach a shared repository. It scans files, directories, Docker images and git history with sub-second incremental scans, is configured centrally with one command per machine and comes with every plan.
NHI Governance
Identity and security teams often hold thousands of vaulted secrets and service accounts but cannot say who owns them, what they grant or whether they are still needed. NHI Governance moves from leaked secrets to the identities behind them.
| Inventory | Secrets and identities across vaults, CI/CD and cloud IAM, collected by ggscout |
|---|---|
| Identity map | Each secret linked to its identity, applications, resources and permissions, so an AWS key in a vault or in Kubernetes is tied to its AWS IAM identity |
| Ownership | Owners identified and relationships between NHIs mapped |
| Risk context | Where each secret is stored and used, its age, whether it is inactive, and whether it has also leaked into code or chat |
| Privilege | Admin-level and overprivileged NHIs flagged across AWS IAM, Entra ID and Okta, with incident severity raised automatically when a privileged identity is affected |
| Policies | Unvaulted, unrotated, duplicated, reused or shared-across-environment secrets, and secrets that are leaked as well as vaulted, measured against the OWASP Top 10 NHI risks |
Ggscout
GitGuardian Scout is a lightweight collector that runs inside the customer’s environment, reads secrets and their metadata from vaults, CI/CD and identity platforms, and sends hashes and metadata rather than raw values. It ships as a binary, Python package, Docker image and Helm chart. Since September 2026 it classifies every collected value with the code-scanning engine, so real credentials can be told apart from placeholders. It can also write secrets found in code into a secrets manager, where the integration allows writes.
Honeytoken
Security operations teams want an early, low-noise signal that an attacker is inside the development environment. Honeytokens provide it: they are decoy secrets created from the dashboard or API and planted in laptops, source control, CI/CD pipelines, internal registries, wikis, messaging and project tools. Any use triggers an alert with the intruder’s IP address, timestamp, source, tags and the triggering event.
How It Works
| Component | What it does |
|---|---|
| GitGuardian platform | Hosts the detection engine, incident management, the NHI inventory and the policy engine. It runs as SaaS, as SaaS extended with GitGuardian Bridge, or self-hosted. |
| GitGuardian Bridge | Gives the SaaS platform secure access to private infrastructure through encrypted tunnels. |
| Self-hosted | Installs on an embedded or existing Kubernetes cluster and supports air-gapped environments. |
| Source integrations | Version control systems and collaboration tools connect natively, so new commits and messages are scanned continuously. |
| Collectors | ggshield runs on developer machines and in pipelines; ggscout runs in infrastructure. Some collectors run in place, such as the GitHub Actions collector, which runs inside a workflow and inventories organisation, repository and environment secrets. |
| Remediation | Incidents are auto-assigned and routed to ticketing and chat, playbooks automate handling, and incidents can be shared internally or through a public link. Platform controls include teams, incident permissions, SAML SSO, an audit log, data retention and privacy mode. |
Identities And Systems Covered
| Secrets and credentials | API keys, OAuth tokens, passwords and other secrets |
|---|---|
| Non-human identities | Service accounts, applications, workloads and AI agents |
| Source code | GitHub, GitHub Enterprise Server, GitLab, Bitbucket and Azure Repos |
| Collaboration tools scanned | Slack, Microsoft Teams, Jira and Confluence |
| Secrets managers | HashiCorp Vault (including Enterprise namespaces, read and write), AWS Secrets Manager, Azure Key Vault (read only), Google Secret Manager, CyberArk Secrets Manager, Delinea Secret Server and Akeyless |
| CI/CD and infrastructure | GitHub Actions and GitLab CI/CD variables, Kubernetes secrets, container images |
| Cloud IAM and identity platforms | AWS IAM, GCP, Microsoft Entra ID, Okta, Auth0, Datadog and Snowflake |
| Developer environments | Developer machines, AI agent caches, AI coding tools, agent skills, plugins and MCP servers |
Agentic AI Capabilities
GitGuardian treats AI agents both as a source of secret leaks and as a new kind of non-human identity.
AI Hooks For Coding Agents
AI Hooks run inside coding tools and block secrets before they are sent to a model. Hooks are documented for Claude Code, Cursor, GitHub Copilot, OpenAI Codex and Mistral Vibe, and ggshield can install them for every agent it finds on a machine with one command.
AI Agent And MCP Inventory
Released in September 2026, this inventory shows which AI agents and MCP servers run on each developer endpoint, whether AI Hooks are installed, and agents running under personal subscriptions. It needs ggshield 1.54.0 or later and the Endpoints licence entitlement.
GitGuardian MCP Server
Announced in July 2025, the MCP Server exposes GitGuardian’s security functions as tools an AI assistant can call, so agents can scan files, find and fix hardcoded credentials, review incidents and insert honeytokens while code is being written. It works with any MCP-compatible IDE, including Cursor and Windsurf. The server is in beta: its Developer profile, with mainly read-focused tools for scanning, incident review and guided remediation, is available, and a SecOps profile is planned.
AI-Assisted Triage
Agentic prioritisation uses AI to triage open incidents, so the most urgent ones reach the team first.
Integrations
| Area | Integrations |
|---|---|
| Alerting, ticketing and SIEM | Email, webhooks, Splunk, PagerDuty, Discord, ServiceNow |
| CI/CD (ggshield) | Jenkins, CircleCI, Azure Pipelines and other pipelines |
| Developer tooling | VS Code extension |
Company Background
| Founded | November 2017 in Paris, France |
|---|---|
| Leadership | Eric Fourrier, co-founder and CEO |
| Funding | A $50 million Series C led by Insight Partners, announced 11 February 2026 |
| Investors | Balderton, bpifrance, Eurazeo, Fly Ventures, Insight, Quadrille and Sapphire |
| Compliance mapping | The platform supports PCI DSS, CIS, NIS2, SOC 2, DORA, ISO 27001, SOX and GDPR requirements |
| Research | Publishes The State of Secrets Sprawl, based on scanning public GitHub. The 2026 edition (GitGuardian, The State of Secrets Sprawl 2026) counted 28,649,024 new secrets in public commits during 2025 |
| Community | More than 16 million developer repositories are monitored through the free GitHub Marketplace app (reported) |
Note: This overview is compiled from GitGuardian’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.