GitGuardian CEO Eric Fourrier didn’t set out to build a company. He built an email. As a data scientist, Fourrier kept finding API keys and database credentials embedded in Jupyter notebooks and code he came across, then discovered he wasn’t alone: an early prototype that scanned public GitHub for exposed secrets and emailed developers a warning was soon sending out 300 alerts a day. The moment that convinced him it was a real business, not a side project, came when the tool flagged an exposed Slack admin API key belonging to NASA, one with access to every file and message in the organization’s workspace. GitGuardian launched in 2018 around a simple mission: help developers and enterprises manage secrets across their full lifecycle, and remediate exposure, not just flag it. “Detection without remediation is just not enough,” Fourrier said. “If I show you a problem but don’t give you the solution, what’s the point?”
That philosophy shaped GGShield, GitGuardian’s open source CLI, which developers embed directly into their workflow: pre-commit hooks, CI/CD pipelines, merge request checks. But Fourrier says the real battleground has shifted over the past year. Public GitHub used to be the primary exposure point; developer laptops are now emerging as the bigger problem. Fourrier described a straightforward attack chain behind roughly 80% of breaches he tracks, whether they start with phishing or a software supply chain compromise: the end goal is almost always to steal credentials, then use them to move laterally or plant malware. A malicious npm package, for instance, doesn’t need a sophisticated exploit to succeed. Once installed, it just reads whatever secrets are sitting in plaintext on the machine and sends them straight to the attacker.
That’s the gap GitGuardian’s newest product, Developer Endpoint Protection, launched in June, is meant to close: making sure secrets aren’t sitting exposed on developer machines in the first place. The scale of the problem, according to fresh research Fourrier shared, is stark. GitGuardian is now finding 15 times more valid credentials on a developer’s laptop than in their public GitHub activity, and 45% of those credentials were created by AI agents themselves, not by the developer directly.
Fourrier also pointed to a shift in who’s creating that exposure. It’s no longer just engineers. Citizen developers in marketing, HR, and sales now have access to code, data, and credentials through AI tools, building applications and workflows on their own laptops with no programming background and, often, no security training. Asked what a security team should prioritize if they can only fix one thing next quarter — rotate old secrets, or stop new ones from leaking — Fourrier didn’t hesitate: stop the bleeding first. With AI agents accelerating code production, he said, no company has ever managed to fully rotate its existing secrets, and waiting to try isn’t realistic while new exposure keeps outpacing it. The fact that 64% of secrets valid in 2022 remain valid today isn’t primarily a tooling failure, in his view. It reflects how difficult security and development teams have historically found it to collaborate on remediation, combined with the fact that the agentic workflows now capable of automating that remediation at scale simply didn’t exist until recently.
##
ABOUT THE AUTHOR
Tom Smith is a technology writer and content strategist with more than 10 years of experience covering enterprise technology, agentic AI, cybersecurity, DevOps, and cloud infrastructure. He has published more than 2,500 articles and conducted more than 4,000 executive interviews across outlets including Coder Legion, Techstrong/DevOps.com, and Insights From Analytics. By day, Tom serves as a content strategist at Cognizant. He can be found on LinkedIn, X, and Bluesky at @ctsmithiii.
