Hey there! If you’re researching different options for a new git secrets scanning solution then you’re probably looking to compare GitGuardian with other solutions to figure out which one is right for you. To help make this as easy as possible, we’ve put together a detailed overview of how GitGuardian stacks up to Gitleaks.
Below you’ll find a very transparent comparison of the main features, and even a set of cases where GitGuardian is not the best choice, and recommendations for when Gitleaks might work better than GitGuardian!
The space is evolving quickly, and we make our best efforts to keep information on our competitors up to date. If you see any information that you consider outdated or unfair with our competitors, please contact us and we will immediately set the record straight!
(for both public and internal monitoring products)
GitGuardian
Gitleaks
GitGuardian
Gitleaks
Yes
-- No
Yes
-- No
Yes
++ Yes (with GitHub actions)
← swipe left
Harvest candidates
Filter false positives
GitGuardian
Gitleaks
Yes - Over %ndet% secrets detectors (API keys, database connection strings, certificates, usernames and passwords, ...)
++ Yes - Regex on characters chains + entropy filters
Yes, in combination with other techniques to get rid of false positives.
++ Yes, but high level of false positive. Entropy level can be customised by end user.
Yes. The context of a presumed credential can help a lot to filter bad candidates (e.g. the import of an API wrapper is a strong indicator of a true positive).
-- No
Yes, where feasible.
-- No
Yes - Ability to exclude folders such as test folders and filter certain credentials like those containing "EXAMPLE" or "QWERTY" in them (placeholders).
++ Yes, manually for each rule you can specify an allowlist regex.
Yes. Approx. %secrets-scanned-in-a-day% alerts sent per day!
-- No
Sensitive filetypes raise specific alerts: policy breaks.
Yes, but only through our support and if the detector can be deployed for all customers. Full ability to define custom detectors to be expected in H2 2021.
++ Yes
← swipe left
GitGuardian
Gitleaks
Yes
Yes, native GitHub app at organisation level (simple integration)
Yes, upon integration of a GHE organization, users can choose to:
- give access to only one repository in particular
- give access to all repositories (and the ones that will be created).
Core detection engine can be used to scan any type of text files (Slack messages, Gdivre, Jira tickets, etc.) More information: here
← swipe left
GitGuardian
Gitleaks
Yes
-- No
Yes
-- No
Native integration
Yes
-- No
Yes
-- No
Native integration (Q4 2021)
Available to push alerts (JSON output format)
Not supported
← swipe left
GitGuardian
Gitleaks
Yes - For example, credentials containing “admin” or “prod” in their context can be prioritized.
Yes
-- No
Yes - Whitelist credentials or folders such as test folders.
++ Yes
Yes - Multiple alerts related to the same leaked credential are grouped and can be resolved in a unified manner. No need to triage/resolve every single occurrence.
-- No
API to retrieve and update secrets incidents
← swipe left
GitGuardian
Gitleaks
Yes - Global Health Status, MTTD / MTTR, etc.
-- No
Yes - Enriched data can be exported in CSV format.
++ Yes (Only one scan at a time)
← swipe left
GitGuardian
Gitleaks
Yes
-- No
Yes - Roles available: Owner / Manager (Admin) / Members.
-- No
Yes
-- No
← swipe left
(On top of general capabilities)
GitGuardian
Gitleaks
GitGuardian
Gitleaks
Yes
-- No - You need to direct Gitleaks against repositories you know exist
Yes - We have the ability to match developers, source code and companies using a unique combination of heuristics. Contact us, we will show you our results for your company!
-- No
Yes - This is where 80% of corporate leaks occur on GitHub.
-- No
← swipe left
GitGuardian
Gitleaks
Yes
-- No
No - GitGuardian Public Monitoring scans only public data, thus on prem is often not a requirement for our customers.
Open source
← swipe left
(On top of general capabilities)
GitGuardian
Gitleaks
GitGuardian
Gitleaks
Yes - Integration at the GitHub Org level with the ability to select monitored repositories
-- No
Yes - Integration at the instance level on full perimeter or at the group level
-- No
Yes - Bitbucket Server/Data Center customer only
-- No
← swipe left
GitGuardian
Gitleaks
Supported but not recommended because "pre receive" can block developers and create friction
Yes, supported natively. Real-time incremental scanning.
Natively integrates with GitLab pipelines, in addition to CircleCI, Travis CI, Drone CI...
Yes, can be launched on-demand through the interface
← swipe left
GitGuardian
Gitleaks
Yes - Integrate GitGuardian as a pre-commit or scan Slack messages for secrets using our API (that can be self-hosted)
++ Yes
← swipe left
GitGuardian
Gitleaks
InfoSec can collect feedback from the developers directly in the dashboard and collaborate in order to remediate.
-- No
Developers have the ability to resolve certain incidents by themselves without involving InfoSec if not needed.
-- No
← swipe left
GitGuardian
Gitleaks
Yes - GitHub only
++ Yes
← swipe left
GitGuardian
Gitleaks
Yes
-- No
Yes - For more than 200 developers or 30k$ annual contract
Open source
Individual developer: Free
Small team (<25 dev): Free
Enterprise (>25 dev): Yearly fee based on the number of developers included in the surveillance perimeter
Free
← swipe left
GitGuardian
Gitleaks
Integrates natively with GitHub, in addition to GitLab and Bitbucket.
-- -
Yes
-- -
REST API to scan any plain text by leveraging GitGuardian’s secrets detection engine.
-- -
← swipe left
Choosing Gitleaks or GitGuardian for git secrets scanning is mostly a question of build or buy. As a famous open source software, Gitleaks is a good base to build on if you decide to build rather than buy.
The answer to the build vs buy question depends on your precise requirements and the exact goals that you’re trying to achieve. For example, you might not need a rich dashboard or real-time scanning, which lowers the cost of building and maintaining an in-house tool.
By the way, we’ve written a comprehensive article if you’d like to explore building a tool such as GitGuardian yourself. In our article, you will learn more about how SAP (NYSE:SAP) built an internal secrets detection solution. Hopefully this will help you!
We also have a significant experience in building TCO analyses and strong use cases for security leadership, so don’t hesitate to contact our sales team.
Review your business needs with us and learn more about monitoring source code for secrets!