A leaked key in a public repo is an expensive way to learn about secrets scanning. GitGuardian scans commits and repositories for leaked secrets such as API keys, tokens and credentials, and alerts you in real time so you can rotate them. The free plan covers up to 25 developers and includes internal secrets monitoring and unlimited real-time scanning. Paid pricing is by quote. G2 has 309 reviews. Users say it caught a real credential quickly and scales to large repositories, and a r/github commenter said it is designed for large organisations so you get far fewer false positives and missed secrets. False positives are still the top complaint on G2, with 10 mentions, followed by limited customisation, inefficient notifications and a confusing interface. One reviewer also says it is mostly focused on secrets detection and remediation. It suits teams of any size that want leaked-credential alerts without running their own scanner.
Free tier quotas
Developers
Up to 25
Real-time scanning
Unlimited
Internal secrets monitoring
Included
Paid plans
By quote
Enterprise trial
Offered
Last sniffed Oct 3, 2026. Always confirm on the official pricing page.
👍 Good boy
+A G2 reviewer said it caught a credential immediately and showed exactly where it was.
+A G2 reviewer described instant secret detection that scales to large repositories.
+The free plan covers up to 25 developers, which suits most small teams.
+A r/github commenter said it is designed for large organisations, so there are fewer false positives and fewer missed secrets than with simple scanners.
+Real-time incident detection narrows the window between a secret being exposed and someone acting on it, according to a G2 reviewer.
+G2 lists 309 reviews and Capterra reviewers also praise detection of password leaks in GitHub commits.
👎 Watch out
−False positives are the top G2 complaint, with 10 mentions, and need manual review.
−G2 reviewers also name limited customisation, inefficient notifications and a confusing interface.
−A G2 reviewer said the mixed experience comes down to false positives, UI friction and pricing opacity.
−A G2 reviewer noted it is primarily focused on secrets detection and remediation, not general vulnerability scanning.
−Paid plans are by quote, so you cannot price a rollout from the website.
−A G2 reviewer asked for more repo-specific customisation of alert rules to avoid flagging dummy test credentials.
The catch
Free is capped at 25 developers. Above that, pricing is by quote, which G2 reviewers mention as a source of opacity.
Expect false positives. They are the most common complaint on G2, and tuning takes time, especially for test credentials and local defaults.
GitGuardian is built for secrets. If you also need dependency or code scanning, pair it with a tool such as Snyk or SonarQube Cloud.
What’s included
✓Real-time secrets scanning of commits
✓Internal secrets monitoring
✓Public GitHub monitoring (platform feature)
✓Alerts and incident workflow
✓Pre-commit hooks and CLI
✓GitHub, GitLab and Bitbucket integrations
✓Non-human identity governance
✓Reporting for security teams
Free tier value
Generosity
A
Estimated value
25 developers free
Feature parity
Core secrets scanning is free for up to 25 developers.
Screenshots
GitGuardian homepageGitGuardian pricing page
Paid plans
Paid plans, by quote
The pricing page directs paid plans to a conversation with sales.
Enterprise trial
The pricing page says an Enterprise trial is included.
Common questions
Is GitGuardian free?
Yes, for up to 25 developers, with unlimited real-time scanning.
What does it detect?
Secrets such as API keys, tokens and credentials in code.
Does it have false positives?
Yes. G2 lists false positives as the top complaint with 10 mentions.
How is paid pricing set?
By quote. The pricing page says to talk to sales.
Should I use it with Snyk?
They solve different problems. GitGuardian finds leaked secrets and Snyk finds vulnerable code and dependencies.
Change history
Checked October 22, 2026
The pricing page lists a free plan for up to 25 developers with unlimited real-time scanning and internal secrets monitoring, and an Enterprise trial.
