Hey there!
If you’re deep in the research process of choosing a secrets scanning solution for your repositories then you’re probably looking to compare GitGuardian with other options to figure out . To help make this as easy as possible, we’ve put together a detailed overview of how GitGuardian compares to Yelp detect-secrets.
Below you’ll find a high level comparison of the main features, and even a set of cases where GitGuardian is not the best choice, and recommendations for when Yelp detect-secrets might be a better option for your needs!
The space is evolving quickly, and we make our best efforts to keep information on our competitors up to date. If you see any information that you consider outdated or unfair with our competitors, please contact us and we will immediately set the record straight!
(for both public and internal monitoring products)
GitGuardian
Yelp detect-secrets
GitGuardian
Yelp detect-secrets
Yes
-- No
Yes
-- No
Yes
-- No
← swipe left
Harvest candidates
Filter false positives
GitGuardian
Yelp detect-secrets
Yes - Over %ndet% secrets detectors (API keys, database connection strings, certificates, usernames and passwords, ...)
++ Yes, only supports 20 types of secrets out-of-the-box
Yes, in combination with other techniques to get rid of false positives.
++ Performs entropy checks to detect generic secrets
Yes. The context of a presumed credential can help a lot to filter bad candidates (e.g. the import of an API wrapper is a strong indicator of a true positive).
Yes, where feasible.
Yes - Ability to exclude folders such as test folders and filter certain credentials like those containing "EXAMPLE" or "QWERTY" in them (placeholders).
Yes. Approx. %secrets-scanned-in-a-day% alerts sent per day!
Sensitive filetypes raise specific alerts: policy breaks.
Yes, but only through our support and if the detector can be deployed for all customers. Full ability to define custom detectors to be expected in H2 2021.
Yes, secrets detection engine can be extended with plugins (requires custom development)
← swipe left
GitGuardian
Yelp detect-secrets
Yes
Yes, native GitHub app at organisation level (simple integration)
Yes, upon integration of a GHE organization, users can choose to:
- give access to only one repository in particular
- give access to all repositories (and the ones that will be created).
Core detection engine can be used to scan any type of text files (Slack messages, Gdivre, Jira tickets, etc.) More information: here
← swipe left
GitGuardian
Yelp detect-secrets
Yes
Yes
-- No
Native integration
-- No
Yes
Yes
-- No
Native integration (Q4 2021)
-- No
Available to push alerts (JSON output format)
-- No
Not supported
← swipe left
GitGuardian
Yelp detect-secrets
Yes - For example, credentials containing “admin” or “prod” in their context can be prioritized.
Yes
Yes - Whitelist credentials or folders such as test folders.
++ Yes
Yes - Multiple alerts related to the same leaked credential are grouped and can be resolved in a unified manner. No need to triage/resolve every single occurrence.
-- Not supported
API to retrieve and update secrets incidents
-- Not available
← swipe left
GitGuardian
Yelp detect-secrets
Yes - Global Health Status, MTTD / MTTR, etc.
-- Not available
Yes - Enriched data can be exported in CSV format.
-- Not available
← swipe left
GitGuardian
Yelp detect-secrets
Yes
-- Not available
Yes - Roles available: Owner / Manager (Admin) / Members.
-- Not available
Yes
-- Not available
← swipe left
(On top of general capabilities)
GitGuardian
Yelp detect-secrets
GitGuardian
Yelp detect-secrets
Yes
-- No
Yes - We have the ability to match developers, source code and companies using a unique combination of heuristics. Contact us, we will show you our results for your company!
-- No, users should point at public repositories they want to scan.
Yes - This is where 80% of corporate leaks occur on GitHub.
-- No, users should point at public repositories or GitHub users they want to monitor.
← swipe left
GitGuardian
Yelp detect-secrets
Yes
++ Open-source CLI and library
No - GitGuardian Public Monitoring scans only public data, thus on prem is often not a requirement for our customers.
++ Open-source CLI and library
← swipe left
(On top of general capabilities)
GitGuardian
Yelp detect-secrets
GitGuardian
Yelp detect-secrets
Yes - Integration at the GitHub Org level with the ability to select monitored repositories
-- No native integration with GitHub
Yes - Integration at the instance level on full perimeter or at the group level
-- No native integration with GitLab
Yes - Bitbucket Server/Data Center customer only
-- No native integration with BitBucket
← swipe left
GitGuardian
Yelp detect-secrets
Supported through GitGuardian Shield (view documentation here)
++ Supported via customization
Supported but not recommended because "pre receive" can block developers and create friction
++ Supported via customization
Yes, supported natively. Real-time incremental scanning.
-- No native integrations with the VCS for continuous scanning.
Natively integrates with GitLab pipelines, in addition to CircleCI, Travis CI, Drone CI...
++ Yes, can be performed via customization of the detect-secrets CLI.
Yes, can be launched on-demand through the interface
++ Yes, can be launched using the audit command from the CLI.
← swipe left
GitGuardian
Yelp detect-secrets
Yes - Integrate GitGuardian as a pre-commit or scan Slack messages for secrets using our API (that can be self-hosted)
++ The detect-secrets library can be used in Python scripts
← swipe left
GitGuardian
Yelp detect-secrets
InfoSec can collect feedback from the developers directly in the dashboard and collaborate in order to remediate.
Developers have the ability to resolve certain incidents by themselves without involving InfoSec if not needed.
← swipe left
GitGuardian
Yelp detect-secrets
Yes - GitHub only
-- Not available. Results are displayed in the terminal.
← swipe left
GitGuardian
Yelp detect-secrets
Yes
++ Open-source CLI and library
Yes - For more than 200 developers or 30k$ annual contract
++ Open-source CLI and library
Individual developer: Free
Small team (<25 dev): Free
Enterprise (>25 dev): Yearly fee based on the number of developers included in the surveillance perimeter
← swipe left
GitGuardian
Yelp detect-secrets
Integrates natively with GitHub, in addition to GitLab and Bitbucket.
++ Yes, works with git repositories
Yes
-- Not supported
REST API to scan any plain text by leveraging GitGuardian’s secrets detection engine.
-- Not supported
← swipe left
Choosing Yelp's detect-secrets or GitGuardian for secrets scanning boils down to the build vs buy question. As a popular open-source library and CLI, detect-secrets is a good base to build a simple secrets detection solution.
The answer to the build vs buy question depends on your precise requirements and the exact goals that you’re trying to achieve. For example, you might not need a rich dashboard or real-time scanning, which lowers the cost of building and maintaining your in-house secrets scanning tool. However, if you are looking to design a complete secrets detection program, you will have to carefully consider remediation and all the complexity it entails: alerting, incident lifecycle management, collaboration between security engineers and developers, etc.
Review your business needs with us and learn more about monitoring source code for secrets!
GitGuardian is the code security platform for the DevOps generation.
With automated secrets detection and remediation, our platform enables Dev, Sec, and Ops to advance together towards the Secure Software Development Lifecycle.
Subscribe to our newsletter to receive the latest content and updates from GitGuardian.
