# GitGuardian vs OWASP ZAP

**Leader by Vioscale score:** GitGuardian

| Attribute | GitGuardian | OWASP ZAP |
|---|---|---|
| **Vioscale score** | 75.1 (71% (medium)) | 51.1 (41% (low)) |
| activity.commits_last_30d | - | 34 |
| adoption.dependent_repos | - | 30 |
| adoption.github_stars | - | 15,685 |
| deployment.options | `{"cloud":true,"hybrid":true,"self_hosted":true}` | `{"self_hosted":true}` |
| description.long | A platform that detects hardcoded secrets and leaked credentials in source code, CI/CD pipelines, container images, developer machines, and public repositories, then automates remediation through context-aware prioritization and integration with existing security workflows. | An open-source security scanner that performs dynamic analysis on web applications to detect potential vulnerabilities. It supports automation, extensibility through community add-ons, and integrates with CI/CD pipelines. |
| features.capabilities | `{"sast":true,"hosting":"both","ci_native":true,"ide_plugin":true,"auto_fix_pr":true,"open_source":true,"reachability":true,"secret_scanning":true,"container_scanning":true}` | `{"dast":true,"hosting":"self","ci_native":true,"open_source":true}` |
| integrations.count | 15 | 2 |
| integrations.list | `[{"name":"GitHub"},{"name":"GitHub Enterprise Server"},{"name":"GitLab"},{"name":"Bitbucket"},{"name":"Azure Repos"},{"name":"Azure DevOps"},{"name":"Jira"},{"name":"Slack"},{"name":"ServiceNow"},{"name":"Confluence"},{"name":"Docker"},{"name":"Container registries"},{"name":"HashiCorp Vault"},{"name":"CyberArk"},{"name":"AWS Secrets Manager"}]` | `[{"name":"GitHub"},{"name":"GitHub Actions"}]` |
| language.primary | - | Java |
| license.spdx | - | Apache-2.0 |
| market.availability | `{"hqCountry":"FR","primaryMarkets":["US","EU"],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | - |
| platform.support | `{"cli":true,"web":true}` | - |
| pricing | `{"type":"subscription","plans":[{"free":true,"name":"Starter","summary":"Free, no credit card required","features":["Internal secrets monitoring","Unlimited real-time scanning","Multi-VCS support (GitHub, GitLab, Bitbucket, Azure Repos)","Developer workstations scan via Git hooks","Remediation tracking and guidelines","GitGuardian CLI (ggshield)","VSCode extension"],"minSeats":25,"description":"For individuals and teams up to 25 devs","contactSales":false,"includedLimits":{"devs":"25","historical_scans":"500","api_calls_per_month":"10K"}},{"free":false,"name":"Growth","summary":"Free trial available","features":["Everything in Starter, plus:","Internal secrets monitoring (code, CI/CD, containers, custom sources)","Public secrets monitoring (limited)","Endpoint protection for developer machines","Remediation playbooks with automated routing","Slack, Jira, ServiceNow integrations","AI-driven risk scoring and false-positive filtering","SSO (SAML 2.0) and SCIM provisioning","US and EU data hosting options"],"description":"For teams up to 500 developers","contactSales":false,"includedLimits":{"devs":"500","teams":"10","repository_scan_size_gb":"12"}},{"free":false,"name":"Business","summary":"Custom pricing via sales","features":["Internal secrets monitoring","Remediation playbooks","Up to 20 teams","Large repository scanning"],"description":"For teams up to 200 devs","contactSales":true,"includedLimits":{"teams":"20","repository_scan_size_gb":"12"}},{"free":false,"name":"Enterprise","summary":"Custom enterprise pricing","features":["Everything in Growth, plus:","Unlimited public secrets monitoring","NHI governance (vault management, identity mapping, policy enforcement)","Endpoint protection (developer and standard endpoints)","Corporate and enterprise data sources (Jira, Slack, Confluence, file storage)","Self-hosted deployment with GitGuardian Bridge","Unlimited teams and custom RBAC","Custom regex-based detectors","12-month audit log retention","Premium Care support"],"minSeats":500,"description":"For 500+ developer organizations","contactSales":true,"includedLimits":{"teams":"None","repository_scan_size_gb":"60"}}],"addOns":[{"name":"Extra endpoints (endpoint protection)"},{"name":"Premium Care support"}],"summary":"Free Starter tier for up to 25 developers. Paid plans start with Growth tier; Enterprise and Business require custom quote.","currency":"USD","freeTier":true,"sourceUrl":"https://www.gitguardian.com/pricing","retrievedAt":"2026-08-14T15:23:02.350Z","billingPeriods":["month","year"]}` | `{"type":"open_source","freeTier":true,"sourceUrl":"https://www.zaproxy.org","retrievedAt":"2026-08-14T15:30:17.577Z"}` |
| pricing.free_tier | yes | yes |
| pricing.model | freemium | open_source |
| pricing.price_level | low | free |
| pricing.transparent | yes | - |
| release.cadence_days | - | 6 |
| release.history | - | `[{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-08-26","date":"2026-08-26T08:35:57Z","type":"prerelease","version":"w2026-08-26"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-08-19","date":"2026-08-19T10:51:56Z","type":"prerelease","version":"w2026-08-19"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-08-11","date":"2026-08-11T14:53:54Z","type":"prerelease","version":"w2026-08-11"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-08-06","date":"2026-08-06T14:19:52Z","type":"prerelease","version":"w2026-08-06"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-07-28","date":"2026-07-28T11:12:43Z","type":"prerelease","version":"w2026-07-28"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-07-21","date":"2026-07-21T16:10:37Z","type":"prerelease","version":"w2026-07-21"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-07-14","date":"2026-07-14T13:46:09Z","type":"prerelease","version":"w2026-07-14"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-07-13","date":"2026-07-13T15:29:09Z","type":"prerelease","version":"w2026-07-13"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-07-06","date":"2026-07-06T14:25:44Z","type":"prerelease","version":"w2026-07-06"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-30","date":"2026-06-30T14:30:23Z","type":"prerelease","version":"w2026-06-30"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-29","date":"2026-06-29T14:01:46Z","type":"prerelease","version":"w2026-06-29"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-24","date":"2026-06-24T16:56:19Z","type":"prerelease","version":"w2026-06-24"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-23","date":"2026-06-23T16:18:04Z","type":"prerelease","version":"w2026-06-23"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-16","date":"2026-06-16T16:08:49Z","type":"prerelease","version":"w2026-06-16"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-09","date":"2026-06-09T13:57:54Z","type":"prerelease","version":"w2026-06-09"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-06-01","date":"2026-06-01T18:13:38Z","type":"prerelease","version":"w2026-06-01"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-05-27","date":"2026-05-27T16:59:12Z","type":"prerelease","version":"w2026-05-27"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-05-18","date":"2026-05-18T16:47:20Z","type":"prerelease","version":"w2026-05-18"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-05-12","date":"2026-05-12T13:45:04Z","type":"prerelease","version":"w2026-05-12"},{"url":"https://github.com/zaproxy/zaproxy/releases/tag/w2026-05-05","date":"2026-05-05T16:56:04Z","type":"prerelease","version":"w2026-05-05"}]` |
| reliability.status_page | yes | - |
| security.disclosure_policy | yes | yes |
| security.gdpr | yes | - |
| security.iso27001 | yes | - |
| security.pci | yes | - |
| security.scorecard | - | 6.8 |
| security.soc2 | yes | - |
| security.vulnerabilities | - | `{"count":1,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=maven&package_name=org.zaproxy%3Azap&per_page=100","last_12m":0,"max_severity":"MODERATE"}` |

## Capabilities (DevSecOps Tools)

| Capability | GitGuardian | OWASP ZAP |
|---|:--:|:--:|
| **Scan types** |  |  |
| SAST (static analysis) | ✓ | - |
| DAST (dynamic analysis) | - | ✓ |
| SCA / dependency scanning | - | - |
| Secret scanning | ✓ | - |
| Container / image scanning | ✓ | - |
| IaC misconfiguration scanning | - | - |
| **Governance** |  |  |
| OSS licence compliance | - | - |
| SBOM generation (SPDX/CycloneDX) | - | - |
| **Remediation** |  |  |
| Automated fix / upgrade PRs | ✓ | - |
| **Prioritisation** |  |  |
| Reachability / exploitability prioritisation | ✓ | - |
| **Deployment** |  |  |
| Hosting | Cloud + self-hosted | Self-hosted only |
| **Integration** |  |  |
| First-class CI / pipeline integration | ✓ | ✓ |
| In-editor / IDE scanning | ✓ | - |
| **Licensing** |  |  |
| OSS engine available | ✓ | ✓ |

*Source: Vioscale. Generated 2026-09-01T16:27:41.829Z. "-" = undocumented, not absent.*