Choosing Soteri for your Secret Scanning Tool vs. GitGuardian and Gitleaks

Security and privacy are a top priority, especially when dealing with scanners that detect secrets.

You must ensure that the scanner operates and retains its findings locally.

The last thing you'd want is for the scanning company to have access to your leaked secrets.

Soteri

Soteri offers a one-click deployment offline solution, meaning data never leaves the premises. While other integrations, may compromise your data, Soteri remains committed to safeguarding your sensitive information.

Soteri provides the most advanced security of the three tools, which is why security professionals from Verizon, Bank of America, FICO, and Northrop Grumman entrust Soteri with their secret scanning.

GitGuardian

Let's break down the security and privacy of GitGuardian by whether or not you're using their on-premises solution or their cloud-hosted solution.

On-Premise

GitGuardian offers on-premise scanning via deployment of its infrastructure to a private cloud specific to your organization.

Selecting On-Premise deployments is almost always the right choice, despite the added complexity of deploying and maintaining a private cloud for GitGuardian deployment. Under no circumstances should your internally hosted repository be accessible via the internet. Keeping it within your internal network enhances security measures, leveraging features such as firewall protection and requiring VPN access.

Cloud Hosted

Here are several reasons why it's not ideal for a secret scanner to communicate its findings over the cloud:

1. Data Privacy and Security – Transmitting sensitive information over the cloud increases the risk of interception or unauthorized access, potentially compromising the confidentiality of the code and findings.

2. Compliance Concerns – Depending on the nature of the information being scanned, there may be legal or regulatory requirements regarding data storage and transmission that must be adhered to. Transmitting data over the cloud could violate these requirements.

3. Control Over Information – Keeping findings local provides greater control over who has access to the information. Once data is transmitted over the cloud, it becomes more difficult to control its distribution and ensure it remains within authorized channels.

4. Reduced Dependency – Relying on local scanning reduces dependency on external networks and services, which can be subject to downtime or disruptions. This ensures that the scanning process remains operational even in situations where internet connectivity is limited or unavailable.

After reading through GitGuardian's privacy policy and public security policy, it's not entirely clear how they handle your data when using their cloud platform.

They are SOC 2 Type 2 certified, which is a sound indication of excellent security practices. However, it is unclear if they collect any data about the discovered secrets, such as the actual secret, your codebase, or any other information that could pose a security risk.

The closest statement I could find about their handling of your sensitive data is from their privacy policy:

"We do not monitor or log data collected from your servers when using the Services, but we may log or monitor information about your access to our Services."

Gitleaks

For repositories that belong to an organization account, a free license key is required and data related to the validation of the key is sent to Gitleaks.

Here's how Gitleaks describes it in regards to running the tool in GitHub Actions:

"The only data that gitleaks-action sends to any third party is data related to license key validation (namely GITLEAKS_LICENSE, repo name, and repo owner), which is sent to the license key validation service, keygen. Your code never leaves GitHub because the scanning takes place within the GitHub Actions docker container."

Gitleaks appears to be a secure way to detect hard-coded secrets, with the only outside communication being the license verification.