February 2020 Summaries

Secrets stored in internal version control systems, while widely acknowledged as a poor practice, remain prevalent due to the growing complexity of modern development environments and the pressure for rapid release cycles. As organizations increasingly adopt cloud architectures and microservices, developers manage more sensitive information, leading to the phenomenon known as "secret sprawl," where secrets unintentionally proliferate across source code repositories. GitGuardian has been addressing this issue by monitoring public GitHub commits since 2017 and issuing over 500,000 alerts to developers to mitigate the risks of exposed credentials. Recognizing the need for improved internal security, GitGuardian now offers a solution for scanning private repositories, providing continuous detection of secrets through integration with CI/CD pipelines and version control platforms like GitHub, with plans to extend support to GitLab and Bitbucket. Their service includes capabilities for scanning existing codebases and tracking incremental changes, offering both free versions for individual developers and open-source projects, as well as trial access for organizations.

GitGuardian, a French cybersecurity company founded in 2017 by Jérémy Thomas and Eric Fourrier, specializes in detecting sensitive information in publicly accessible code on platforms like GitHub, which could potentially lead to significant financial damage if exploited by malicious hackers. Recently, the company secured $12 million in funding from Balderton Capital to expand its operations, primarily targeting the American market, which constitutes the majority of its client base. GitGuardian's technology stands out for its rapid detection capabilities, identifying vulnerabilities within seconds as opposed to the industry norm of around 100 days. With a strategic focus on the US market, the company plans to grow its team significantly while maintaining its technical base in France. The funding will also help GitGuardian stay ahead of potential competitors in a market that is still relatively untapped, allowing them to enhance their product offerings and customer loyalty. The company's client roster includes large American corporations and well-known tech firms, although specific names remain confidential due to the secretive nature of the cybersecurity industry.