Understand how GitGuardian compares with TruffleHog v3, so you can find the best fit for you.
Hey there! If you’re deep in the research process of choosing a new git secrets scanning solution then you’re probably looking to compare GitGuardian with other options to figure out whether it might be right for you. To help make this as easy as possible, we’ve put together a detailed overview of how GitGuardian stacks up to TruffleHog v3.
Below you’ll find a high level comparison of the main features, and even a set of cases where GitGuardian is not the best choice, and recommendations for when TruffleHog v3 might work better than GitGuardian!
The space is evolving quickly, and we make our best efforts to keep information on our competitors up to date. If you see any information that you consider outdated or unfair with our competitors, please contact us and we will immediately set the record straight!
(for both public and internal monitoring products)
GitGuardian
TruffleHog v3
Enriched interface and centralization of incidents
GitGuardian
TruffleHog v3
Rich UI with all data needed for investigation and remediation
Yes
No
InfoSec team view (global view)
Yes
No
Developer view (local view)
Yes
No
← swipe left
Detection
Harvest candidates
Filter false positives
GitGuardian
TruffleHog v3
Regular expressions to match known, distinct patterns
Yes - Over %ndet% secrets detectors (API keys, database connection strings, certificates, usernames and passwords, ...)
TruffleHog v3 covers 600+ types of specific secrets.
High entropy checks to match credentials without distinct patterns and enter “paranoid” mode
Yes, in combination with other techniques to get rid of false positives.
TruffleHog v3 does not support entropy checks yet – link to GitHub repo
Contextual analysis
Yes. The context of a presumed credential can help a lot to filter bad candidates (e.g. the import of an API wrapper is a strong indicator of a true positive).
Yes
Credential validity checks
Yes, where feasible.
Yes, where feasible.
Dictionary of anti-patterns
Yes - Ability to exclude folders such as test folders and filter certain credentials like those containing "EXAMPLE" or "QWERTY" in them (placeholders).
Yes - Ability to exclude folders such as test folders.
Feedback loop to constantly improve the algorithms
Yes. Approx. %secrets-scanned-in-a-day% alerts sent per day!
No
Ability to define custom detectors
Yes, but only through our support and if the detector can be deployed for all customers. Full ability to define custom detectors to be expected in H2 2021.
Yes
← swipe left
Alerting
GitGuardian
TruffleHog v3
Real-time alerting
Yes
No
Email alerting
Yes
No
Integration with most common SIEMs or ITSMs
Yes
No
Slack alerting
Yes
No
← swipe left
Incident Life Cycle Management
GitGuardian
TruffleHog v3
Collect and structure weak signals to prioritize incidents
Yes - For example, credentials containing “admin” or “prod” in their context can be prioritized.
No
Ability to assign incidents / mark them as resolved / etc.
Yes
No
Whitelisting
Yes - Whitelist credentials or folders such as test folders.
Yes - Whitelist folders such as test folders. No native ability to whitelist credentials.
Grouping / deduplication of alerts
Yes - Multiple alerts related to the same leaked credential are grouped and can be resolved in a unified manner. No need to triage/resolve every single occurrence.
No
← swipe left
“Shift left”
GitGuardian
TruffleHog v3
Put the developer in the loop
InfoSec can collect feedback from the developers directly in the dashboard and collaborate in order to remediate.
No
“Auto-heal” incidents
Developers have the ability to resolve certain incidents by themselves without involving InfoSec if not needed.
No
← swipe left
Reporting
GitGuardian
TruffleHog v3
In app
Yes - Global Health Status, MTTD / MTTR, etc.
No
Data exporting
Yes - Enriched data can be exported in CSV format.
Yes - Data can be exported in CSV or outputted in JSON.
← swipe left
Security
GitGuardian
TruffleHog v3
SSO authentication
Yes
No
RBAC
Yes - Roles available: Owner / Manager (Admin) / Members.
No
Audit trail
Yes
No
← swipe left
(On top of general capabilities)
GitGuardian
TruffleHog v3
Monitoring
GitGuardian
TruffleHog v3
Monitor all GitHub public activity, at scale
Yes
No - You need to direct TruffleHog v3 against repositories you know exist.
Reliably filter public activity on GitHub that is linked with your company
Yes - We have the ability to match developers, source code and companies using a unique combination of heuristics. Contact us, we will show you our results for your company!
No
Identify and monitor developers’ personal repositories
Yes - This is where 80% of corporate leaks occur on GitHub.
No
← swipe left
Deployment
of the solution
GitGuardian
TruffleHog v3
Available in SaaS
Yes
No
Available On Prem
No - GitGuardian Public Monitoring scans only public data, thus on prem is often not a requirement for our customers.
Open source
← swipe left
(On top of general capabilities)
GitGuardian
TruffleHog v3
Integration with the Version Control System
GitGuardian
TruffleHog v3
GitHub native integration
Yes - Integration at the GitHub Org level with the ability to select monitored repositories
TruffleHog v3 scans GitHub repos but does not offer a native GitHub app.
GitLab native integration
Yes - Integration at the instance level on full perimeter or at the group level
TruffleHog v3 scans GitLab repos but does not offer a native integration.
Bitbucket native integration
Yes - Bitbucket Server/Data Center customer only
No
← swipe left
Secure the SDLC and more
GitGuardian
TruffleHog v3
Detection API to integrate anywhere in the SLDC and the tools developers use
Yes - Integrate GitGuardian as a pre-commit or scan Slack messages for secrets using our API (that can be self-hosted)
Yes, TruffleHog v3 can be integrated with git hooks.
← swipe left
Alerting
GitGuardian
TruffleHog v3
Notification for the developer, directly in the VCS frontend
Yes - GitHub only
No
← swipe left
Deployment of the solution
GitGuardian
TruffleHog v3
Available in SaaS
Yes
No
Available On Prem
Yes - For more than 200 developers or 30k$ annual contract
Open source
Pricing
Individual developer: Free
Small team (<25 dev): Free
Enterprise (>25 dev): Yearly fee based on the number of developers included in the surveillance perimeter
Free
← swipe left
Multi source scanning
GitGuardian
TruffleHog v3
VCS
Integrates natively with GitHub, in addition to GitLab and Bitbucket.
Scans repos hosted on GitHub and GitLab but does not offer a native app.
Docker image scanning
Yes
No
Other sources
REST API to scan any plain text by leveraging GitGuardian’s secrets detection engine.
AWS S3 buckets, and filesystems are supported.
← swipe left
Choosing TruffleHog v3 or GitGuardian for git secrets scanning is mostly a question of build or buy. As a famous open source software, TruffleHog v3 is a good base to build on if you decide to build rather than buy.
The answer to the build VS buy question depends on your precise requirements and the exact goals that you’re trying to achieve. For example, you might not need a rich dashboard or real-time scanning, which lowers the cost of building and maintaining an in-house tool.
By the way, we’ve written a comprehensive article if you’d like to explore building a tool such as GitGuardian yourself. In our article, you will learn more about how SAP (NYSE:SAP) built an internal secrets detection solution. Hopefully this will help you!
We also have a significant experience in building TCO analyses and strong use cases for security leadership, so don’t hesitate to contact our sales team.
You want a turnkey solution with capabilities that go beyond detection such as dashboarding, alerting, incident lifecycle management and reporting, etc.
You have hundreds of repos or hundreds of developers and you’re looking for an enterprise-grade software.
You fall in our free tier, and free and easy-to-use is great!
You don’t fall in our free tier and you don’t want to pay for a solution.
You don’t have that many developers, repositories or secrets to protect so it is not worth paying for a professional software.
Open Source is fun, and when you have the choice it is your preferred way to go!
You’re willing to monitor internal repositories, you don’t want to send any data to a SaaS and you don’t want to manage GitGuardian on premise as well.
Review your business needs with us and learn more about monitoring source code for secrets!
GitGuardian is the code security platform for the DevOps generation.
With automated secrets detection and remediation, our platform enables Dev, Sec, and Ops to advance together towards the Secure Software Development Lifecycle.
Subscribe to our newsletter to receive the latest content and updates from GitGuardian.
